📝
Home
Pentesting
  • 📝Home
  • ⚒️PENTESTING
    • Foundational
      • Gaining Access
      • Session Hijacking
      • Buffer Overflows
        • Finding the Offset
        • Spiking
        • Fuzzing
      • Attack Basics
        • Brute Force Attacks
        • Credential Stuffing and Password Spraying
        • Netcat Shell Stabilization
        • Reverse Shells vs Bind Shells
        • Staged vs Non-Staged Payloads
      • Footprinting
    • Reconnaissance
      • Discovering Email Addresses
      • Hunting Subdomains
    • Scanning and Enumeration
      • Banner Grabbing
      • Enumerating HTTP and HTTPS
      • Enumerating SMB
      • Enumerating SSH
      • NetBIOS Enumeration
      • SNMP Enumeration
      • Sniffing
    • Privilege Escalation
      • 🐧Linux Privilege Escalation
      • 🪟Windows Privilege Escalation
        • Initial Enumeration
    • Defense Evasion
      • Hiding Files and Covering Tracks
      • Network Evasion
    • Attacking Services
      • Attacking Kerberos
      • Attacking VPNs
      • Denial of Service
      • Exploiting FTP
      • Exploiting NFS
      • Exploiting SMTP
      • Exploiting Telnet
    • Attacking Active Directory
      • Initial Attack Vectors
        • Gaining Shell Access
        • LLMNR Poisoning
        • SMB Relay
        • Passback Attacks
        • IPv6 Attacks
      • Post-Compromise Enumeration
        • Bloodhound
        • ldapdomaindump
        • PowerView
        • PlumHound
      • Post-Compromise Attacks
        • GPP Attacks
        • Print Nightmare
        • Token Impersonation using Incognito
        • URL File Attack
        • Pass Attacks
        • Kerberoasting
        • LNK File Attacks
        • Mimikatz
      • Post-Domain Compromise Attacks
        • Dumping the NTDS.dit
        • Golden Ticket Attacks
      • Post Exploitation
    • Toolkit
      • Burp Suite
        • Intruder
      • Hping
        • Crafting TCP and UDP Packets
      • Metasploit
        • Meterpreter
        • Shell Handler
        • Gather Information
        • Gaining Root
    • Web Application Hacking
      • Attack Methodology
      • Attacking Web Applications
      • Authentication Bypass
      • Cross-Site Scripting
      • Cross-Site Request Forgery
      • File Inclusion
      • Server-Side Request Forgery
      • Injection
        • Command Injection
        • LDAP Injection
        • SQL Injection
  • 👽MALWARE ANALYSIS
    • Malware Analysis Primer
    • Malware Types
      • Rootkits
      • Viruses
      • WannaCry
    • Analyzing Malicious Windows Programs
    • Static Analysis
      • Basic Static Techniques
      • Advanced Static Analysis
    • Reverse Engineering
      • Crash Course in x86 Disassembly
      • Recognizing Code in Assembly Language
    • Dynamic Analysis
    • Detecting Malware
      • Evasion Techniques
      • Detecting Mimikatz
      • Hunting Malware
      • Hunting Metasploit
      • Hunting Persistence
  • 🏹THREAT HUNTING
    • Foundational
      • ATT&CK Framework
      • CIA Triad
    • APTs
  • 🐍PROGRAMMING & SCRIPTING
    • Foundational
      • Computer Memory
    • C Programming
    • Assembly Language
      • Assembly File Structure
      • Debugging with gdb
    • Bash
    • Python
      • Foundational
        • Booleans and Operators
        • Comprehensions
        • Conditionals
        • Dictionaries
        • Exceptions and Error Handling
        • Functions
        • Lambdas
        • Lists
        • Loops
        • Modules
        • Numbers
        • Reading and Writing Files
        • Sets
        • Sockets
        • String Formatting
        • Tuples
        • User Input
        • Variables
      • Extending Python
        • Virtual Environments
        • Sys Module
        • Requests
        • pwntools
    • Regular Expressions
    • SQL
  • 🕵️DIGITAL FORENSICS
    • Anti-Forensic Techniques
    • 🪟Windows Security Internals
      • Windows Security Internals
        • Kernel
          • Security Reference Monitor (SRM)
          • Object Manager
            • System Calls
            • NTSTATUS Codes
            • Object Handles
            • Query and Set Information System Calls
          • The I/O Manager & The Process and Thread Manager
          • The Memory Manager
          • The Configuration Manager
  • 💼GRC (CISSP Notes)
    • Security Assessment and Testing
    • Security Governance Principles
    • Security Policies Standards and Procedures
    • Preventing and Responding to Incidents
    • Organizational Roles and Responsibilities
    • Organizational Processes
  • 📦Networking
    • Foundational
      • DHCP
      • DNS Basics
      • HTTP Protocol
      • IPSec
      • IPv6 Fundamentals
    • Wireless Technologies
      • 802.11
      • Bluetooth
      • Wireless Authentication
      • Wireless Encryption
Powered by GitBook
On this page
  • HTML Request Methods
  • HTTP Response Messages
  1. Networking
  2. Foundational

HTTP Protocol

  • Designed to transfer hypertext

  • Designed as a request-response Application layer protocol where a client requests hypertext from a server

  • HTML Entity

    • A way of telling the browser to display those characters it would otherwise look at as a tag or part of the programming itself

    Reserved Character in HTML

    HTML Entity Version

    "

    "

    '

    '

    &

    &

    <

    <

    >

    >

HTML Request Methods

  • GET Method

    • retrieves whatever information is identified by the Request-URI

    • Visible in a browser

    • can also be used to send data (problem is that it adds the data to the URL)

      • For example: http://www.example.com/checkout?7568.asp/credit1234567890123456

  • HEAD Method

    • the server does not have to return a message-body in the response

    • usually used for testing hypertext links for validity, accessibility and recent modification

    • Also used to request headers and metadata

  • POST Method

    • Used to request that a web server accepts the data enclosed in the body of the request message, usually by just storing it

    • It is a better and safer method than GET to submit data to a resource for processing

    • Safer because admins can make it so it is not stored in browser history or in the server logs

    • Does not display returned data in the URL

    • Visible with a Wireshark capture

  • PUT Method

    • Requests that the enclosed entity be stored under the supplied Request-URI

    • If it points to an existing resource - the enclosed entity should be considered as a modified version of the one already on the origin server

    • If it points to a resource that does not exist - the origin server creates the resource

  • DELETE Method

    • Requests that the origin server delete the resource identified by the Request-URI

  • TRACE Method

    • Used to invoke a remote, Application layer loopback of the request message

    • Final recipient of the request should reflect the message received back to the client as a 200 (OK) response

  • CONNECT Method

    • Reserved for use with a proxy that can dynamically switch to being a tunnel

HTTP Response Messages

  • The first digit of the Status Code defines the class or response

  • The last two digits do not have any categorization role but define the response intent

    • 1xx: Informational - Request received, continuing process

    • 2xx: Success - Successfully received, understood and accepted

    • 3xx: Redirection - Action has to be taken to complete the request

    • 4xx: Client Error - Request contains bad syntax or cannot be fulfilled

    • 5xx: Server Error - Server failed to fulfill an apparently valid request

PreviousDNS BasicsNextIPSec

Last updated 1 year ago

📦