"Page not found", “Sorry, that door’s locked.” “Try again.” “Welcome inside.”
You’ve seen those messages before. Only, they’re not in words — they’re in HTTP status codes.

For hackers, these codes are like the responses you get from a building when you try every door, knock on every wall, and peek into every window.

🔍 What Are Status Codes?

When you visit a site or send a request (like with curl, gobuster, or nmap), the server responds with a status code — a 3-digit number that tells you what happened.

But instead of memorizing a dull list, I started mapping them to real-world situations. Here's how I now remember what each one means — like a hacker.

💬 Status Codes, Hacker Style

🔓 200 OK
“Come on in. Everything’s fine.”
The page or resource exists, and you’re allowed to see it. This is what you want.

🛑 403 Forbidden
“Yes, the door is there… but you don’t have the key.”
The resource exists, but you’re not allowed to access it. Hacker eyes light up: Why? What’s behind it?

🧱 404 Not Found
“That door doesn’t even exist.”
You’re either guessing wrong or there’s nothing there. Not as exciting, unless you suspect misdirection.

🚪 301 Moved Permanently / 302 Found (Redirects)
“That door’s been moved. Follow me.”
These mean you’re being redirected — possibly to HTTPS, a new domain, or deeper inside the app.

🔐 401 Unauthorized
“There is a door, but you need a badge.”
This is a login gate. Sometimes sending an Authorization header or cookie will let you through. A juicy lead.

🧯 500 Internal Server Error
“You broke something. Or it was already broken.”
The server crashed while processing your request. Could be a bug, misconfig, or something worth investigating.

📦 503 Service Unavailable
“The shop is closed. Try later.”
Server’s down temporarily or overloaded. Not your fault — but interesting to note if it keeps happening.

🧠 Why Hackers Care About These

When you’re scanning or brute-forcing:

A 200 means your guess hit something real.
A 403 might mean you’re close — but blocked.
A 404 helps eliminate dead paths.
A 301/302 might help you find login portals, admin redirects, or API gateways.
A 401 or 500 might suggest something deeper is breakable or misconfigured.

In bug bounties, CTFs, or red teaming, the pattern of status codes tells you where to push harder — or back off.

🧪 My Hands-On Moment

While using gobuster recently, I saw lots of 404s… until one 403 popped up.

That was enough to make me pause.
If it's forbidden, it means it exists.
And if it exists, someone thought it was important enough to protect.

🔁 TL;DR

Status codes talk back — learn to listen.
They help you filter noise, spot targets, and map the structure of a web app.
Even errors and blocks are valuable feedback in the recon phase.

Understanding Status Codes Like a Hacker

Table of contents