‫HTP Hypertext Transfer Protocol is an application protocol, hypertext is structured text that uses
‫logical links between nodes containing text and HTTP is the protocol to exchange or transfer hypertext.
‫HTTP is a stateless protocol.
‫That means no information is retained by either sender or receiver.
‫HTTP functions as a request response protocol in the client server computing model.
‫A web browser, for example, may be the client and an application running on a computer.
‫Hosting a website may be the server.
‫The client submit an HTTP request message to the server.
‫The server, which provides resources such as email files and other content, returns a response message
‫to the client.
‫The response contains completion status information about the request and may also contain requested
‫content in its message body.
‫The most used HTTP request is get a get request is designed to request server resources.
‫Were these types of requests, the parameters are sent to the server inside the U R L.
‫You see two different H.M. elements which will cause get requests.
‫Post request is designed to request server resources as well as get request.
‫But unlike get requests, parameters are sent to the server inside the body of the request instead of
‫the URL.
‫It's still possible to send the parameters inside the URL, but if you use post request, you should
‫prefer sending parameters inside the body the URL.
‫In this slide, you see the HTML elements to send a post request.
‫What's that you ask?
‫What's the advantage of sending parameters inside the body instead of a URL?
‫Good question.
‫Almost always, the traffic between the server and the client is logged on the server side.
‫Such log files usually contain the URL.
‫If you send the parameters in your URL, they are saved as clear text in your log files.
‫So anyone who can see the log files can also see your sensitive parameters.
‫You should use post requests to send sensitive data, but please make a note that it's not enough for
‫the privacy of the traffic because any man in the middle who listens to the network will see the parameters
‫even though they're inside the body of the request message, so you should encrypt your traffic.
‫The server, which provides resources such as HTML files and other content, returns a response message
‫to the client.
‫The response contains completion status information about the request and may also contain requested
‫content in its message body.
‫Every response has three-digit response status codes.
‫Responses with a code starting with one are informational responses.
‫An informational response indicates that the request was received and understood it is issued on a provisional
‫basis, while request processing continues.
‫It alerts the client to wait for a final response.
‫The message consists only of the status line and optional header fields and is terminated by an empty
‫line.
‫Responses with the code starting with two means success.
‫This class of status code indicates the action requested by the client was received, understood, accepted
‫and processed successfully.
‫Responses with the code starting with three mean redirection.
‫This class of status code indicates the client must take additional action to complete the request.
‫Many of these status codes are used in URL redirection, a response with the code starting with four
‫shows that there is an error that seems to have been caused by the client.
‫For example, if the requested resource is not found on the server, you get a 4x x coded response.
‫Five x x coded responses mean that the server failed to fulfill an apparently valid request.
‫HTTPS consists of communication over HTTP within a connection encrypted by TLS transport layer security
‫or its predecessor, SSL Secure Sockets layer.
‫The main motivation for HTTPS is authentication of the visited website and protection of the privacy
‫and integrity of the exchanged data.
‫There are a few questions we should ask about using SSL or TLS.
‫Does the application have a version working without SSL?
‫If it has, the user might be tricked to connect over http, or an attacker can perform an SSL strep
‫attack to turn an HTTPS connection into an HTTP connection.
‫Which versions of SSL or TLS are allowed by the server?
‫The older versions of SSL and TLS have weaknesses, so it's not safe to use them as a certificate of
‫the application been signed by a valid certificate authority, which algorithms are used for encryption
‫and are they strong enough?
‫There are tools such as SSL scan and SSL Digger to test the SSL or TLS configuration of the server.
‫You can find the tools in Kali Linux.
‫In addition, there are some browser plugins to analyze the SSL or TLS of the application.
‫You can try Calomel or Comodo SSL plugins for Firefox, so even though it might seem a bit off topic,
‫we can quickly see how a typical encrypted connection between the server and the client is established.
‫The client sends the information that the server needs to communicate with a client using SSL.
‫This information contains a client's SSL version number cipher settings session specific data.
‫The server sends the information that the client needs to communicate with the server over SSL server
‫also sends its own certificate.
‫The client uses the information sent by the server to authenticate the server using all data generated
‫in the handshake thus far.
‫The client creates the pre master secret for the session, encrypts it with the servers public key,
‫and then sends the encrypted pre master secret to the server.
‫The server uses its private key to decrypt the pre master secret, and both the client and the server
‫perform a series of steps to generate the master secret.
‫Then they use the master secret to generate the session keys, which are symmetric keys used to encrypt
‫and decrypt information exchanged during the SSL session and to verify its integrity.
‫The client then sends a separate message indicating that the client portion of the handshake is finished.
‫The server sends a separate message indicating that the server portion of the handshake is finished.