-: How do we communicate with a website?
Most of you probably know this already,
but I will mention it in this video
just so we can get a quick refresher.
We explained all of these attacks
in the previous video,
but it's important we know the basics
behind communication,
between a client and our website.
So we send requests
and receive pages back,
with the help of HTTP requests
and HTTP responses.
HTTP request is something that we send to the website
once we want to get a certain webpage from that website,
and HTTP response is a response
from the website telling us that either it found the page
that we were looking for or it didn't.
HTTP response also contains an HTML code
of the web page that we requested.
Now, this would be a basic explanation of the process,
but let us also take a look
at how an HTTP request
and a HTTP response look like.
So, if we take a look at this image right here,
in the red letters, we can see
HTTP request to some webpage.
While in the blue letters, we see an HTTP response.
Let us focus first on HTTP request.
So some of the known fields from the HTTP request
would be ones you see in the image.
We got hosts
and that field defines the website domain,
that you're searching for.
Sometimes this field can also have a port number,
due to web servers,
sometimes hosting more than one website.
Besides that, we also got the user agent field,
and this field is used
by server to identify the client
that is connecting to the server.
By identifying I mean,
it'll usually identify the web browser,
that the client is using.
HTTP request can also have cookies,
which we can't see here in this picture,
but what cookies are our values exchanged
between a client and a server
that are used for holding data,
and information about a certain session that the user has.
Sometimes an HTTP request can also have
authorization parameter,
which is used to check for the identity.
With this parameter, usernames and passwords
are sent to the website.
On the other hand, we got an HTTP response,
which also has some special fields of its own.
First thing we see, is the status code.
Now, a field called status code doesn't exist,
but the value will be stored in the first line
of the response.
Most of you encountered at some point a 404 error
once you try to search for a certain web page,
a 404, in this case, is a status code.
In this picture,
we can see a status code of 200,
which indicates that the page exists
and that we loaded it successfully.
Besides this, we got set cookie field,
and this field, if defined,
will establish values of cookies to the client.
This value server can use later to identify the client,
and to also store client's data.
We also got field called cache control,
and this field is used if the content
of the response should get stored
inside the browser of the client, or not.
And we also got content length,
that will tell us size of the response in bytes.
Below all of these fields,
we can see HTML tags opening,
and down there,
is the web page that we requested
from this website.
It sends us the webpage code that will then
get rendered inside of our browser,
and it'll show us the web page.
Simple as that.
Great.
Now that we refreshed our memory about this,
let us finally start attacking websites.
See you in the next video.