>> Hello everyone.
>> Welcome back to the course
>> identifying web attacks through logs.
>> After our brief review of web application architecture,
let's now talk about HTTP and TCP.
First, consider this affirmation,
one of the differences between TCP and UDP
>> is that TCP establishes a connection
>> through a process called a three-way handshake.
>> Is this affirmation true or false?
This affirmation is true.
The three-way handshake is the process that TCP
uses to establish the connection
between a client and a server.
UDP does not do this,
it only sends the packets.
That's why TCP is called connection oriented
>> and UDP is connectionless.
>> Later, we will talk about the impact of TCP
>> through a handshake in the log analysis.
>> Let's start talking about learning objectives.
In this video, the learning objectives
are a brief review of HTTP,
followed by a review of the IP and TCP model.
After, I'll present our infrastructure lab.
Let's start talking about HTTP.
HTTP means Hypertext Transfer Protocol.
Here's the definition of what a protocol is.
>> A protocol is a set of rules to allow communication,
>> the set of rules is defined in RFC.
You can check it in this web page.
As we said before, with
HTTP the clients will send questions to the server,
the server will then answer.
The HTTP is how the clients and server talk.
Two things are really important to know,
>> first, HTTP methods are sent by the clients
>> and they tell the web server
>> what the clients want to do;
>> the second one is the status code.
The status code is a way
>> in which web servers tell clients
>> what the server did with the request.
>> In summary, the browser will send a GET
>> and it goes through a network,
>> the web server receives it
and answers back with a status code,
the web client will get the answer
>> and show you the page.
>> The method is like a comment.
The HTTP status code is a result of this comment.
What are these HTTP methods?
Here's a table of methods.
The most commonly used are GET and POST methods.
GET request results like a file,
image, or some other resource.
POST sends something to the web server
>> like usernames or passwords.
>> RFC classifies the methods with some properties.
One of these properties is if the method is safe.
A safe method is one that is read-only.
The method should not change anything
>> on the web server.
>> However, as we have seen in this course,
GET can be used to perform attacks
like brute-force attacks or HTTP floods.
Other properties can be found in
>> Section 4.2 of the RFC.
>> Now, the status code.
The status code will tell us
>> how the web server processes the client requests.
>> The most common codes are inside five families of code.
The 100s, these are informational codes,
>> 200s, are codes for successful operations,
>> 300s mean redirections,
>> 400s mean client error i.e.
>> the client performed an incorrect request,
and the 500s indicate a server error.
The web server could not answer
the request because of an error,
this can be caused by attacks,
misconfiguration, or overload.
In this slide,
>> I will review the most common status codes.
>> It's important to know some of them.
Let's discuss some.
>> The 200 means okay.
>> This means that the web server answered
>> and the client would get the answer.
>> 302 is the most common for redirections.
This happens when one webpage
sends you to another for example,
after you put in your username and password
the web application can send you to another webpage.
404 occurs when the web server
doesn't find the requested resource.
It can be a typing error from the user,
wrong web page called in the code,
or someone trying to find information.
You can check all the codes in the RFC.
After this brief review of HTTP,
let's talk about TCP/IP.
HTTP is an application protocol like DNS or SMTP.
Since HTTP is an application protocol,
it uses the application layer
and it is located at the top of
both the OSI and TCP/IP models.
HTTP uses lower layers to reach
a destination like clients and servers.
Usually, HTTP uses TCP port 80.
Other ports like 8080 are possible as well.
If you see an S after HTTP,
the S stands for secure.
It means that the HTTP is transferred, encrypted.
The most common port to HTTPS is 443.
Like HTTP, it's possible to see
the HTTPS running in a lot of TCP ports.
Now, why should we care about
TCP/IP if the web server and clients who use HTTP?
As I said, HTTP uses TCP/IP.
To clarify, here we have a package capture
for our communication
>> between a client and a web server.
>> The first three lines are the TCP/IP communication,
the three-way handshake.
The TCP/IP communication is handled
>> by the web server operational system.
>> The HTTP doesn't care about it.
If a client is a web browser,
it will say to the operational system
that a three-way handshake will occur,
and the operational system
will reach out to the web browser saying,
we're connected with the server.
You can use this connection
>> to send your HTTP information.
>> Then the next line is the HTTP request, here a GET.
This means that HTTP
>> and HTTPS communications only start
>> after the TCP three-way handshake.
>> The web server will only log
>> the HTTP or HTTPS requests.
>> For this communication, the web server
will only show one logline.
To finish, here are the topologies
>> that we will use during our course.
>> We have an attacker machine
>> and a vulnerable web application.
>> The web application is the OWASP,
broken web application project application.
Between the attacker and the application,
there is a firewall.
Everything here is virtual.
The process will be that we will use
the attacker machine to attack the web application.
After the attack, you start the logs,
you analyze them to identify the attack.
We also have a web server on the Internet
>> to get some real logs.
>> These logs will be used as an example.
Now, answer the question.
>> Link the web server status code on the left
>> with its description on the right.
>> Here you have the answers.
Just to remember, the 200 means success or okay.
For the next question, consider this scenario.
You are a stock analyst
>> and someone shows to you a package capture below.
>> Suppose that you need the web server logs.
How many lines will you have
>> in the web server log for this communication?
>> A two lines,
B four lines,
C one line
>> or D zero lines.
>> The answer is letter C, one line.
As we said before,
the HTTP communication starts
after the three-way handshake,
we only have one HTTP request.
What that means is that we only have one logline.
In this video, we talked about HTTP
>> and two important components.
>> HTTP message sent by the clients to the web server,
and HTTP status codes sent
>> from the web server to the clients as the answer.
>> Finally, we reviewed a little TCP/IP protocol
and how it's related to HTTP.
In the next video,
>> we will talk about logs and their importance.
>> We will identify key information
>> in the web server logs.
>> After, we will do some analysis on
the most common web server software logs
>> like Apache, NGIX, and Microsoft IIS.