Hello everyone. Welcome back.
Since this entire course is dedicated session, hijacking. Let's
try to understand what is a session also
will try to understand how our sessions being
implemented on both web. And network will
just go to the basics for now. And the
next module will take a deep dive on various implementation mechanisms.
So what's called the session session
is nothing. But the connectivity that is being established between
a client and a server.
All the devices over the network has to set up a
communication in which each of those is going to send
a request and the server is going to respond back
with an appropriate response. So,
each session is going to be identified
with a unique value known as session ID. So
these such an IDs are generally, a
numeric or alphanumeric value based on the implementation from
the development side.
So, these each session ID will be uniquely mapped with
a user in order to identify who is sending the
request.
Now, let's take a look at the web based implementation. So
over the web, the default protocol that would be used is http.
So HTTP protocol is bad, fall stateless. So
what does that mean? So ideally the
web server cannot store the information to
uniquely identify the client. Since
each of this request is being understood
on isolation or one-to-one basis. So
now let's take try to understand the scenario.
So the internet, let's assume a case where there's
an EB, c.com web server.
So once a user a is trying to send
a request, he will send out is one
session ID once he's been authenticated.
Or with a thought in authentication as well. This
is done in order for the web server to
uniquely identify each user since
over a period of time. We may have multiple users
sending out multiple requests. So
the prediction are you? We can see that both the users a and
user be have a unique session ID. So this
is how Servo is going to respond back to each user
based on the requests that they
send it out.
Along with those, she protocol also sends
out multiple headers. So in this
scenario, we can see the type of request. The user agent
is nothing, but a browser that is being used to send out the request. What
is a domain name? And what are
the data types or what are the separate inquiry mechanisms?
Now similarly, let's try to take an overview about the
network protocol. So in this particular scenario, let's try to
understand how TCP works. So unlike HTTP TCP
is a connection-oriented protocol also
known as a true connection. So that means it is going to
maintain the information about the session till the time. It
is active TCP. Protocol is also known
as three-way handshake protocol, which is also known as syn synack
and ack. The first step. The
client is going to send out a syn packet.
Informing the servo to initiate a session in
the response. The particular server
is going to take the syn packet from the client increment,
with a value of 1 and
set, an acknowledgment packet with another random value. So,
in that way, the client, once it receives it,
once it calculates, the increment value
of 1 for the same, it does understand the server
as receptors request, and it has also sent out
an acknowledgement packet.
So in the final step, the client is going to
send back the college packet, incriminate the value of one and
sent back to the server. So in that way, both
client and server, both know that
both have accepted the request and have sent the response and the connection has been
established.
So in this particular section, we have looked at both stateless session
in which three cosas process in isolation and
the stateful session in terms
of TCP where each and every request is being tracked and
maintained until the session is acted.
That is what this video. Thank you.