A crafted HTTP request is a deliberately built web request designed to make a server, proxy, or management interface behave in an unexpected way. Attackers shape headers, parameters, paths, cookies, or encoding so the target parser sees something different from what a defender expects. This can expose logic bugs, access-control mistakes, request-smuggling issues, or authentication bypasses.
In cyber security, crafted requests matter because many attacks begin with a single HTTP exchange that probes how a system handles edge cases. They are common in vulnerability research, exploit development, and penetration testing, where unusual input is used to trigger hidden code paths or reveal inconsistent validation. Defenders look for these patterns in logs, WAF alerts, and reverse-proxy traces, especially when management interfaces or other high-value web endpoints are reachable. Normalizing input, validating requests consistently, and limiting exposure reduce the risk.