All right, so welcome back, everyone.
This is a station on learning something.
I mean, this this is about learning SCDP.
All right.
So let's get started.
As should be is pretty well known, of course, but we'll be understanding the next SCDP from the Nutshell
will be understanding the flow of a certainty so that it would help us to understand what other security
challenges with it and how we can probably exploit different application accordingly.
OK, so what is exactly SCDP?
In a nutshell, SCDP is a sort of four methods, are it?
It's burring.
You get a speech and each of the text that you see on and on a Web page, it is linked to another Web
page and that Web beach having a text.
And again, the text, each of the text can be linked to another Web page.
Right.
So that when you have a chain off of Web pages connected to text and that's possible because of hypertext.
All right.
So that is that is SCDP, something which is now used everywhere on the Internet.
Without this, the government can not even exist.
Right.
And let's understand the flow.
But so in this situation, you can see the user and the server user.
The first thing that anybody do, once they are ready to surf the Internet, they just open the browser
and type the name of the site.
Right.
Maybe up Google dot com, stop initiating the net method, making use of NetBank while going by going
through their bank account and all those stuff.
Right.
So the first thing the very first thing that happened is users sent a request.
Right.
And that request goes to the Web server like this.
And that is basically SCDP request.
And on response to it, the server sends the S&P response.
It's that easy, but is it really that easy?
I'll tell you what it is if you understand it in a different way, when means and the request is that
you send the request to somebody as well.
It's your Web browser who is the which is the basically the interface to the digital world.
Your Web browser is doing selecting the selecting the request and receiving the response.
There are many, many different types of requests.
Right.
But you never select that.
It's on your Web browser who decide where to put which kind of response.
Right.
So your Web browser, take care of all those activities and now and even your Web browser, take care
of the response as well.
So it's the job of your Web browser to take care of it.
But in order to in order for us to understand and exploit and possibly hack the Web application, we
need to understand how Web application exchange the data back and forth with the Web servers.
Right, with the Web browsers.
So let's get started.
Let's understand both the points SCDP request and the response one by one SCDP request.
The first type of request is to get requests.
Now, get requests is pretty similar to asking for, hey, I want to get the resources on this.
You are probably on the site.
Let's say I want to get there.
So I want to get the want to get the list of all capped list of all images in the world.
Right.
So what I want to do, you just go to the Google and the search engines.
Is Digance right gappy me?
Just what's going to happen is you will get the list of all the images on your browser.
So what basically happened is if you if you search that you see on the browser, on the on the top and
the you are the side.
You see, you have been moved to some directory to Google dot com slash, maybe search and then some
some time into question mark and then slash and then Gantt's and multiple results.
Right.
So you basically asking for all the resources under that you are and that's going to get requests that
are doing the data from the server.
There's one more request.
SCDP request is just a post be post is pretty similar to uploading any data or upload method, but not
exactly.
But it's all about submission of your.
So what kind of situation?
Let's say you have a login form and you submit your username and password.
That's where the post metaphor comes in, what method, but method is pretty similar to post it just
in spite of sending a whole new data you just beat when your browser need to update any existing data
you make use of put update date already present on that server.
Delete, delete is all about deleting the data from the server.
It's that easy.
These are some of the well-known SCDP request.
If you find anything other than this, probably you can exploit those requests as well.
I'll show you how can how can we exploit such request methods to retrieve some confidential information
or probably give the access to the Web services.
But these methods has to be open and working on the Web servers in order for for the Web servers to
serve on the users.
Right.
Let's understand the EDP response now.
SCDP response rate.
So when you see the SCDP response for everything, for every request, there are different SCDP response
which has been built, so it ranges from one thousand to 5000.
So understand anything which starts with one exec says it could be any random number.
It could be 100 as well, one zero one as well.
But anything that starts with this, it's always information that could be notification on the stuff,
request, receive process and all the stuff.
What is really important is the 206 number.
So if you see 200, this means, okay, you would you would get a promising 200, OK, that means you
ask for something and yes, it is there.
So there's no problem with that.
Successfully receive, understood and accepted.
So you will always see 200 or 300 OK, created that's gotten that kind of response coming in from a
website.
That's the response rate 300.
It's always redirect for their action must be taken very, very clear to all the stuff could be moved
to a new Rivara.
So if you have reached out to some site and that has been redirected to some else, nowadays it is being
used a lot because many site make use of papers and all the stuff.
So maybe you make use, you go to any, any, any travel site.
The moment you make a payment, you go to another site, you from there you go to another e-commerce
site or probably from there to maybe fired and more site as well.
This is when this happened.
You get a response saying, OK, we are moving, we are moving your request to another site and you
get a response saying it's a three to one and three to four as well in case it's not modified 400.
It's pretty, pretty difficult, pretty difficult and pretty critical for most of the network, our
application admin as well, because if you see a prompting for 04, that becomes a challenge.
That means you ask for something you send let's say you send a request on a certain you are to maybe
images on a specific maybe e-commerce site and there is no got images available.
I'm not talking about Google search engine.
Let's say you are online or on any Amazon, maybe, let's say, and you search for any requests for
resources, maybe got address.
So if Amazon don't sell it, the page won't be available or maybe any sort of stuff.
Right.
So if that resource is not available, you will get a response saying four zero four on maybe.
And there is a support page on any website.
You thought that, OK, I don't get any response.
I'm not happy with their service.
Let's click on Support Page.
And they might they might not be having the support beat and they just might have mentioned it.
Right.
So if they don't have the resources available, you would get a problem saying for Xeroform, that's
a challenge.
That means they're not available for that request download stuff.
Right.
So that's the kind of major barometer's available then.
Of course, you have celebrator.
If you have 500 CD's response coming in, it could be several failed to fulfill in about and about apparent
valid requests.
And you would probably get up and done a server in those situations.
And this is all about how the SCDP works in terms of request and the response rate.
We have seen different dippie request methods so as to keep your request.
And of course, the institute response as well in the next session will be practically looking at how
this works from the browser site and when while you browse and look for different Gath images, what
exactly your browser doing at that moment of your time.
All right, Will got you in the next session then.
Thank you.