2. Ports and Protocols: SSH, HTTP, HTTPS, FTP/SFTP and DNS
2.3 HTTP – Port 80
HTTP ha web cha bhasha aahe. Browser request pathavto, server response deto. Burp Suite shiktana (Part 10) tumhi hech requests pakdun badlnar aahat, mhanun structure nit samja.
GET /login.php?next=/profile HTTP/1.1 <- method, path + query, version
Host: shop.example.com <- which website (virtual host)
User-Agent: Mozilla/5.0 ...
Cookie: PHPSESSID=8f2c1a... <- session identifier
<- blank line, then optional body
HTTP/1.1 200 OK <- status line
Content-Type: text/html; charset=UTF-8
Set-Cookie: PHPSESSID=8f2c1a...; HttpOnly
<html> ... </html>
| Method | Meaning | Typical use |
|---|---|---|
| GET | Read a resource; parameters in the URL | Open a page, search |
| POST | Send data in the body | Login form, upload |
| PUT / PATCH | Replace / update a resource | REST APIs |
| DELETE | Delete a resource | REST APIs |
| HEAD | Like GET but headers only | curl -I |
| OPTIONS | Which methods are allowed | CORS pre-flight |
| Status class | Meaning | Examples |
|---|---|---|
| 1xx | Informational | 101 Switching Protocols |
| 2xx | Success | 200 OK, 201 Created, 204 No Content |
| 3xx | Redirect | 301 Moved Permanently, 302 Found, 304 Not Modified |
| 4xx | Client error | 400 Bad Request, 401 Unauthorized, 403 Forbidden, 404 Not Found |
| 5xx | Server error | 500 Internal Server Error, 502 Bad Gateway, 503 Service Unavailable |
curl -I http://example.com # only headers
curl -v http://example.com # full request and response
Why this matters for security
Plain HTTP is readable by anyone on the path (Wi-Fi, ISP, a compromised router) – passwords and cookies travel in clear text. HTTP is also stateless, so applications use cookies/sessions; stealing a session cookie (for example through XSS) means logging in as the victim. Almost every web attack in the OWASP Top 10 is a manipulated HTTP request.
Ravindra Bagale's Tip
401 aani 403 madhe khup students gondhaltat. 401 mhanje "tumhi kon aahat he mala mahit nahi – login kara" (authentication), 403 mhanje "tumhi kon aahat he mahit aahe, pan parvangi nahi" (authorization). Interview madhe ha farak nakki vichartat – ekdum simple, pan lakshat theva.
Practice task
Run curl -v http://example.com -o /dev/null and identify: the request line, the Host header, the status code and two response headers.