Hello everybody and welcome back.
And in this tutorial we will cover some of the basic terms that you need to know in order to understand
better things to cover in the web.
Penetration Testing section.
So let me just stop in here please bed and enlarge it a little bit.
So first thing I want you to know is basically some of the most basic terms which is for example HDP
now we already covered what it is in the basic networking terms and basic ethical hacking terms but
here we need to cover it a little bit more in details.
So each ETP is our Hypertext Transfer Protocol.
It is basically used on all of your uh Web site pages as you can see.
We open up any page you will either have an AC DP or it's a P S right here.
And as we already said before the difference between these two is that ATP s uses SSL RTL s encryption
in order to protect your files from anyone trying to interfere with your internet connection.
So basically if this was energy DP website without the s anyone could anyone that is putting himself
in the middle between me and this website can basically read all of my information.
For example if there was a log in page right here as you can see log in right here.
And if I type your my username and password he could get them in plain text while as with the SSL until
s encryption all my data would be encrypted and he wouldn't be able to get anything out of it.
So that is another thing that you can check every time you log in somewhere.
For example your Facebook page your Instagram page any page.
Basically today shouldn't be a CTP.
If you open up a page for example Facebook and it says right here only DP It is most likely going to
be a fake Facebook page and someone is phishing for your credentials.
So that is an important thing.
Now also the next thing I want to tell you about is the ETP Heather's now SDP Heathers we will cover
them in great detail later on with our burps too.
But from now on there are basically two things you need to know which eats parties and HDP request and
watches and what is an EDP response.
Will cover the HDP requests right now.
So let me just open up a picture that I downloaded which is basically request Heather.
It will show you how uh HDP header request looks like.
And we will cover some of the parts that it chose.
So basically let us just open this picture first.
Here it is.
This is a typical age TTP.
Heather request Heather.
So let me just enlarge this a little bit so you can see better as we can see there are a few stuff right
here that we need to know about.
First of all what is the HDP request.
Well HDP request is basically every time you type here Google dot com on your.
For example Firefox you just opened here and type here.
Google and dot com it will perform an H CTP request for this page.
Now what I mean by that is we as clients request the page and server census back the page with the shitty
response.
And that page contains the h the email the HDP responds and so on so on.
Now basically it's typical requests says some of the options right here that I will explain right now.
The get as you can see to get the part right here is a method ETP method which basically references
to the website that we tried to search.
So if we tried to search Google dot com right here it would type.
Get Google dot com.
Since we tried to get to that Web site.
So it is simple as that.
You just translate this into English and basically just s to get that page from the server.
The protocol right here as you can see which is HDP one point one is just a current version of the DP
and the path as we can see right here is the current path that we searched for example as you can see
right here the path would be slash projects slash or WASP PBA that would be the path if we searched
this page the host would be the server that we search for.
So the host will be the name of the website that we typed in our search bar.
So in our case right here source for dot net would be the host the user agent is basically this is what
server uses to identify every client.
So we we are ETP request we send to server also some of our own information for example.
What kind of web browser we're using which in this case is Mozilla for endpoint 5.0.
What is our operating system in this case it is windows and so on and so on.
So basically use range it is ourselves with our web browser here we can see except text NHT email basically
here we specify as a request what do we want to what do we accept from the server in return.
And we basically accept the estimate.
Actually each the e-mail page which is most likely what we are going to get.
So let me just show you the ECMO is basically a code that you use to write these websites you can check
out the HD e-mail code of every page with the right click on the page and check the source code once
it opens this up.
This is basically an HMO code which starts with head body and so on.
It has a bunch of things it's not really that hard to learn and it is the essentials of every website
you visit.
So it's good to know that as well so let's just get back to our GDP request the accept language as we
can see right here is basically the language as it says English us except encoding GC deflate.
So we do accept encoding.
There are certain texts that we can use in order to remove this encoding and basically get the file
in plain text
except char set which is UTF minus 8.
So keep alive three hundred connection keep alive their these options that we do not really care about
but the one that we do care about is the kooky.
Now what is a cookie.
Cookie is basically a temporary value that is used to keep our information about the current session
that we're having.
So without cookies the server would after every request forget who we are and wouldn't know what research
for example before or what our user name and password was so basically it wouldn't know who are we in
the previous request.
The cookie is stored in this on the server and it basically has all the information about our current
session.
Now we can see the pitch session idea and this is basically the cookie itself it is a random number.
It is also one of the main points of the attacks as we can see if we were for example to change this
cookie value to something else we would be logging in into a different session which could be potentially
dangerous.
Now there is another option right here in the HDB request headers that isn't listed right here and it
is the authorization.
Now with this parameter ETP enables the identity checker client.
So for example if I log in into my router
let me just 192 168.
That one that one this window little window that will pop up right here it should pop up any second.
Here it is is basically authorization.
So this is how the my how my Rato checks the identity of me if I know the user name and password I can
log in.
If I don't know the user name or password I can't again.
So those are some of the basics of the EDP request headers.
Uh there is also some of the other things you should keep an eye on which is session tracking with cookies.
It is an important one as I said also HDMI all you need to know what HDMI is which most likely you do.
It is our code that is basically used in order to create websites so we can see right here.
This is the email code
and that is about it for the HDP headers.
Uh request headers now.
I will also discuss the HDP response headers which are similar but basically stupid response is as it
says a response from the server to us.
So the SDP request is what we send to the server and HRT response is what server sends back to us.
So we will discuss that in the next tutorial and I hope I see you there.