HTP.
So HTP stands for hypertext transfer protocol.
Today, it's used to access Web applications on the World Wide Web.
So it is the underlying protocol that helps us to retrieve Web applications, HTP is basically a client
server protocol.
And it has a message based model to carry traffic between the server and the client, so the client
request resource on the server and the server runs a response message to the client.
HTP 1.0 was the first release, which, well, it's considered obsolete today, but it's still possible
to see if you're testing an application on an Internet.
So bear that in mind.
HTP 1.0 one has replaced the older version and it's the most common version that's out there.
Use today resistant connexions option method and improvement in caching mechanisms are just a few of
the better features of one point one.
As the Internet evolves, HTP is extended and leveraged with new features, even new releases come out
to support today's more complex applications.
So latest version was published in May 2015 as HTP to now.
HTP, too, has many great features.
Basically, this new release removes the performance based issues for Web applications.
And it's also supported by modern Web browsers and updated servers.
All right, so after this new version pops up, I need to update some of my rhetorical sentences about.
Normally it's a text based protocol, but now it's a binary protocol with HDB to.
Now, it is an application layer protocol in the TCP IP model, so that means it uses stateful TCP as
a transport mechanism, although HTP in and of itself is a connection, this protocol that makes requests
and responses to use different TCP connections, but with HTP two, they can use the same TCP connection.
And by the way, it uses the default port 80 on the server, unless the Web server and the client are
configured to use a different port.
I want to flag that up for you as a pen tester, because an application can be served on another port.
So first, let's talk about the HDP request and responses.
And HTP request is made by the Web browser.
And HDB responses are sent by the server.
So let's have a look at the HTTP request message.
Request messages are comprised of two parts.
The message headers and the message body.
Headers provide both a server and a client instructions on how to handle the message, so the structure
of a request looks like this.
First, the mandatory lying comes, and this lying consists of an HTP method, the path or you URL of
the resource and the supported HTP version, then request headers come.
And then headers are followed by a mandatory blank line.
And finally, the message body is added to the request, and that is the real HDP request data.
And this request is sent to the server.
OK, so now let's have a look at the structure of an HTTP response, the structure of a response message
is similar to a request message.
Again, the mandatory first line now this time it consists of the HTTP version, HDB status code and
phrase.
Then the HDB response headers come.
And then the headers are followed by mandatory blank line.
And then finally, the message body comes and that's the HTP response data just like that, and then
this response is sent to the client.
Now, sometimes if there is no data to be sent between each party, the message body can be neglected.
So now let's have a look at how to examine these messages from the browser.
So HTP messages contain useful data to gather information about applications or also to manipulate applications.
So what we need to do is capture the whole HTP traffic sources between us and the Web server to extract
the information.
Now, there are several ways to capture the traffic, and the most common way is to use a local HTP
proxy.
I'll show you that in detail in the next video.
For now, I am going to observe right here in my browser, HDB Traffic with the developer tool.
So developer tools are very useful to analyze the application in the Web browser.
So first I just open the web developer tool.
And there are several tabs within this internal tool.
And HDP messages are listed and viewed under the network tab.
And then go to the vulnerable applications login page.
So as you see here, HDTV requests are listed below.
And also, we can list documents by their types, our only list HTML documents now.
Now, I'm going to click on the first request to see the details.
And over here, the right pane of the tool, there are details about the request, such as HTTP headers,
cookies, parameters and so on.
Now, this view may be different in other browsers.
And now the tool displays data about the request and response in its own particular way.
OK, so normally there are three items in the first line of every HTTP request separated by spaces.
But developer tools show the request not quite like this.
So this is not the raw data, but you can get the raw data as well.
So the first part contains a URL, htp method and version information.
Now, an HTP method defines how to use a source on the server or what to do with it.
As I said before, the client should inform the server about the action that it wants to perform on
the requested resource write.
So a Web browser can display, delete or update a resource by declaring an HTTP method in the request
now because there are several HTTP methods, they all work differently.
But mostly what you'll see is get and post method's.
Get is, I would say, the most used one.
And what it does is it helps to display a resource on the server, get requests to not have a message
body, so you cannot send data in the message body.
But it doesn't mean that you cannot send data with the get method because get can transmit any parameter
to the requested resource in the you are ill with a query string.
So this is a practical way to send data.
But a parameter like that becomes part of the URL, and that means it's prone to sniffing and as a weapon
tester, you should try to force the application while transmitting confidential data, whether it uses
get or not.
The post method is similar to the get method, and it's used to retrieve data from the server.
So now I'm going to log into the application.
As you see, the data is sent via the post method.
And she was the post request from a list.
And the post method has the message body, and it mostly transmits the data to the server in this way.
Now click the programs tab.
Here is a login data that I entered, but the get method transmits data via query string in the early.
So choose.
The HTML injection example from the list in the page.
And fill in the input fields with some data and hit at her.
Click the request.
And now look at the data in the euro.
Then open the programs tab.
And this time it is identified as a query string.
So it is entirely and absolutely vital to use the post method while transmitting confidential data you
get me.
Now, in addition to the get and the post methods, there are a few others put the elite head and options,
the put and delete methods are part of Web dev, which is an extension of the HTTP protocol.
Put creates a new resource or replaces the target resource using the content contained in the body of
the request.
So as pen testers, we may be able to upload a malicious file to the server if this method is enabled.
And that elite method deletes data on the server, as the name would suggest.
So these are called dangerous methods and you might be able to guess why.
So in other words, you should analyze the application for these available HTTP methods.
So to check the available methods on a server and other HDTV method can be used, the options query,
which is an HTTP method on the server.
So click, edit and send.
Now, I'm going to change the method to option.
And delete this part.
Vincent.
And the server returns a response and declares an allowed header which stores the available methods.
And let's have a look at the available methods.
Here they are.
So head is another method.
And it checks whether a resource is present on the server or not.
And it works the same way as a method.
So this time I'm going to change the method to head.
And send the request.
And here is a basic header information for this application.
So it's a quick way to get some information from the server.
And HDP supports many headers, some of the headers that can be used for both requests and responses
and others are specific to one of these message types.
So why don't we start with some of the request headers?
The homesteader specifies the hostname in the Eurail, it can also be an IP.
The point here is that it is absolutely necessary if there are other Web applications on the same server
that share the same IP address.
User agent specifies information about the client software.
Then if the request is generated by the Web browser, it is going to contain browser information, see
why that would be useful.
Cookie submits cookies to the server that the server previously issued.
So cookies can be used for many reasons by the servers, software or developers, and we're going to
come back to cookies a little bit later on in details, but we need to need to learn a few more things
first.
So referrer is used to indicate the address of the previous Web page, which the client requests the
current page from.
Also, this letter was misspelled in the original HTTP specification, and it's still used like that.
Except encoding.
Defines the compression scheme supported by the client grip and deflate are among the most common ones.
So except tells the server about the content types that the client can accept, such as image type office
document formats and so on.
Conexion tells the other party to close the TCP connection if the TDP transmission has completed or
keep it open for further messages.
Content encoding tells the other party about the encoding used for the content of the message body such
as Guiseppe.
OK, great.
So now let's have a look at the response message.
So here is a status code which represents the result of the request.
OK, so it's a numeric value and it's followed by a textual reason phrase.
The OK message.
So each HTP response message must contain a status code.
There are five groups of status codes, status codes that start with one is informational.
Status codes, it start with to define success message.
Status codes, starting with three, are used for redirection status codes, starting with for defined
errors caused by the client status codes that start with five defined errors caused by the server.
For example, 200, 300 to four, a four or five hundred.
Those are some of the more popular ones.
So 200, OK, indicates that the request was successful and that the response body contains the result
of the request.
And then when I log out, I'll get a three or two.
And the three of two found redirects the browser temporarily to a different U.
URL, which is specified in a location header.
Now, if I request a nonexistent resource, I will get a 404.
Four or four not found indicates that the requested resource does not exist.
OK, so some response headers.
So the server header provides information about the server software used in the server computer.
And some time some other details, such as installed modules in the server operating system, can be
included as well, not mandatory.
But you're looking at it here.
So PRAGMA directs a browser not to cash.
The response expires, tells a browser for how long the content of the response is valid.
And the browser caches of content until that time.
Content type identifies the type of content in the message body, such as text or HTML for HTML document
content length specifies the length of the message body in byte.
Cash control passes cashing directives to the browser.
So in this response message, there is no set cookie header set Cookie submits to the client additional
parameters named cookies.
Now, cookies can be used for any reasons, but typically they're used for authorisation.
Now we're going to recap cookies in the next section in full detail.