Web Application Security 101 - 02 The Basics
0 likes510 views
The document provides an overview of the Hypertext Transfer Protocol (HTTP), detailing its simple text-based structure for transferring documents and the components of requests and responses. It discusses the evolution of HTTP, including the introduction of features like authentication, sessions, and the use of SSL for encryption. Additionally, the document explores different methods used in requests (GET, POST, etc.), data encoding formats, and provides challenges for hands-on learning application.
Web Application Security 101 - 02 The Basics
- 1. The Basics Hypertext Transfer Protocol And More.
- 2. History Of HTTP Specified in the early 90s. Very simple text-based protocol. Designed for transferring text-based documents.
- 3. How It Is Built A request and a response. Request/response line, headers and a body. Lines delimited by the CRLF characters (0x0d, 0x0a)
- 4. Typical HTTP Request GET /path/to/something HTTP/1.1 Host: hostname User-Agent: Mozilla/5.0 ... Accept: text/html,application/xhtml+xml,/;q=0.8 Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3 Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 300 Connection: keep-alive Referer: http://i/came/from/here
- 5. Typical HTTP Response HTTP/1.1 200 OK Date: Wed, 23 Nov 2013 10:10:10 GMT Server: Some Server Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 1337 Keep-Alive: timeout=15, max=100 Connection: Keep-Alive Content-Type: text/html;charset=UTF-8 body
- 6. Browser → Server Specify the method: GET, POST, HEAD, OPTIONS, etc. Specify the location: a URL/URI(Unified Resource Locator/Identifier). Tell the server more stuff how you want the data: headers. Provide optional body.
- 7. Browser ← Server The server responds with status code: 2xx(ok), 3xx, 4xx, 5xx(not ok). It is followed by extra information: headers. There is also optional body.
- 8. HTTP Request Deconstructed METHOD location VERSION Header1: Value1 Header2: Value2 body
- 9. HTTP Response Deconstructed VERSION code MESSAGE Header1: Value1 Header2: Value2 body
- 10. In Summary Plain text format made of lines. Lines are segmented by the CRLF characters. Each part made of initial line, headers and a body. Guarantees simple implementation across different technologies.
- 11. Some Observations No authentication! No encryption! No sessions! No streaming!
- 12. HTTP Develops The spec is extended with HTTP/1.0and later HTTP/1.1. Streaming, Authentication, Sessions, Virtual Hosts and more.
- 13. HTTP Authentication There are several kinds: basic, digest, ntlm. Basic auth is based around base64 encoding. Digest is based around challange/response. NTLM is proprietary protocol developed by Microsoft.
- 14. HTTP Encryption A layer underneath HTTP called SSL. SSL stands for Secure Socket Layer. It works as a wrapper around sockets.
- 15. HTTP Sessions The HTTP protocol is completely stateless. Sessions enable state typically stored as cookies. Cookies are a simple storage provided by the browser. Cookies are restricted byte SOP (Same Origin Policies). Cookies also have various security flags: httpOnlyand secure.
- 16. Enough? There is so much more to learn.
- 17. Virtual Hosts Initially one HTTP server per box. This used to be very wasteful pre-virtualization era. The hostheader was introduced to enable multiple sites per box.
- 18. Transport Mechanisms Content-Length: <size>- the body has a length. Transfer-Encoding: chunked- the body is made of chunks.
- 19. Transport Encodings application/x-www-form-urlencodedis used for sending forms. multipart/form-datais used for submitting files. application/jsonis used for uploading/downloading json. application/xmlis used for uploading/downloading xml.
- 20. Data Encodings URL encoding: %followed by the hex representation of a character. Entity encoding also known as XML encoding: &<entity>;. Base64 encoding: everything is represented by 64 characters ASCII.
- 21. GET vs. POST Here is a GETrequest where parameters are in the URL: GET /path/delete.php?username=guest HTTP/1.1 Here is a POSTrequest where parameters are in the body: POST /path/delete.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 14 username=guest Sometimes GETand POSTare substitutable.
- 22. REST Architectural style of programming predominately for APIs. DELETE /username/guest HTTP/1.1
- 23. HTML Hyper Text Markup Language <html><head></head><body></body></html>
- 25. JSON JavaScript Object Notation {"key": "value"}
- 26. Lab We will learn how to apply all of this.
- 27. Simple Challenges 1. Make a simple GETrequest . 2. Make a simple POSTrequest . ⇢ ⇢
- 28. Moderate Challenges 1. Make an authenticated request with basic auth . 2. Make an authenticated request with cookies . 3. Make a form data (file upload) request . ⇢ ⇢ ⇢
- 29. Advanced Challenges 1. Make a proxy request .⇢