Web Hacking 101 - HTTP



HTTP - defines how client and server have to communicate in order to deliver requests and responds.

What happens when we enter URL in address bar, and then hit ENTER:
  • Browser pulls the domain name from URL (www.google.com, for example)
  • PC sends DNS request to DNS server searching for domain's IP address
  • PC gets response from DNS servers and now it has IP address attached to that URL.
  • PC sets up TCP connection with that IP address, on port 80.
  • When PC connects to server, he sends HTTP request that looks like this:
GET / HTTP / 1.1
Host: www.google.com
Connection: keep-alive
Accept: application/html, */*
  • After he has sent the request, PC waits for server response.
  • He gets it and it looks something like this:
HTTP/1.1 200 OK
Content-Type: text/html
<html>
    <head>
        <title>Google.com</title>
    </head>
    <body>
    </body>
</html>
  • Browser renders the HTML, CSS and JavaScript and builds GUI based web site shown on the scree.
When talking about requests and responds, HTTP has something called HTTP Verbs. Previously, we have seen, in request message, there is GET verb. We will talk few words about some of these verbs that can be used in HTTP transmission.

The GET verb (method, as it is called), asks server to pull whatever information that sits inside URI (address bar). GET method is used when we want to "get" information from server, into our browser.

The POST method is used when we have to make server do something with that request of ours. We use POST method when we are sending information to server, not requesting it, like when we use GET method. For example, POST method will be used when sending login credentials for authentication, deleting user, posting a comment, registering new user. We are sending something to the server, and then server decides what to do with that (accept username and password combo, respond back with error, discard request or something like that)

The HEAD message is identical as GET method, just in HEAD response server does not send message body in response. From the example above, number 7, HTML text would be HTTP body, and using HEAD method server must not send anything in it.

PUT method is similar to POST, but it is used when updating something to the server. Again, we are invoking server to do something but here we are telling him to update account, update comment etc.

DELETE method sends request that invokes server to delete resource identified by URI

The  TRACE method sends back request to the requester in order to see how it looks and what server receives from the browser. TRACE method is used for testing and diagnostics

CONNECT method is reserved for proxy use

OPTIONS method used when we want to ask  server what HTTP methods he accepts. For example, using OPTIONS method, and sending a request to server, he should respond with options that he accepts. He may accept GET, POST, PUT, DELETE and OPTIONS, but not HEAD or TRACE methods.

Credit goes to: Web Hacking 101 Book
Used for my personal educational purposes.