Network Security Blog

PAC FILE:-

Its a java script based, given in IE>LAN settings.
user(delft)------browsing xyz.com--->WEBSERVER
user(delft)<------server sends PAC file--WEBSERVER
Here PAC file contains which Proxy that it need to use based on location.
user(delft)------www/https--------->Proxy(Delft)----->INTERNET

Inside PAC file we can define which traffic needs to be send to Proxy and Direct.
There are If conditions :-
isPlainHost
defining hostnames, URL with wildcards, IP address etc.

HTTP:-

TCP 3 way handshake will be handled by Proxy.

once proxy receives GET request then it establishes TCP-3 way handshake with Server.

+when a browser accesses an HTTPS URL, it verifies the server’s certificate. During the verification process, it will also check for revocation;

+Serial number is noted down.

+it downloads a CRL file from url mentioned in CRL distribution points

+In CRL file it checks whether evernote serial number present or not, if present then we get an error saying “certificate is revoked”

Disadvantages:-

=============

+has to check 1000's of lines

+CRL is updated every 5-15 days,till then it is will be trusted.

+if CRL file is not downloaded, the site will be trusted

 

 

OCSP(Online Certificate Status Protocol):-

Browser---OCSP req(Serial num)----------------------->CA

Browser<---OCSP response(Good/Bad/Revoked/Unknown)---CA

+Client sends OCSP Request to a OCSP Responder (over HTTP) with the certificates serial number.

+OCSP Responder replies with a certificate status of either Good, Revoked or Unknown

 

 

GET /tutorials/other/top-20-mysql-best-practices/ HTTP/1.1
Host: net.tutsplus.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 (.NET CLR 3.5.30729)
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate =====================>it tells it supports zip format.
                so that in response it     sends  in zip format which saves Size and BW.
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300

Connection: keep-alive ============================>allow the client and server to use the same TCP connection

                            to send and receive multiple HTTP requests and responses. this helps avoiding a new 3 way handshake for new connection. HTTP 1.1 allowed by default. 1.0-closed

**if HTTP req is not received by server within keepalive time it will close the connection.**

***HTTP KEEPALIVE or HTTP persistent :- to know if the client is dead or alive***

***TCP KEEPALIVE:- ** to see if server is dead or alive**

Cookie: PHPSESSID=r2t5uvjq435r4q7ib3vtdjq120
Pragma: no-cache  ============================>defined in HTTP 1.0

Cache-Control: no-cache ============================>defined in HTTP 1.1

X-Forwarder-For=shows original client ip address through a Proxy server or Loadbalancer.(dev by squid proxy)

TYPES OF CACHE:-
Browser cache: web browsers maintain a small cache.
proxy cache:- like riverbed. Client ----proxy server----Server
Header caching policy:- these are set by Owner or the server.
1)EXPIRES:- it sets a time, once it is expired http req are sent to the server.
2)MAX-AGE:- same as EXPIRES. value is in seconds.
2)CACHE CONTROL:- another way instead of EXPIRES.
3)E-TAG:-used for cache validation.
PC<----E-tag=X@#$, max-age=120<------------Server
once cache is Expired
PC--->Etag=X@#$same as above------------->Server -===>for validation.
PC<----E-tag=is same<---------------------Server  ===>server will tell to use same cache or it will give new data.

no-cache:-everytime cache is validated with server using E-TAG.

no-store : Helpful for banking applications, where the response will not be stored at all.
Public:-means the data is public can be cached by intermediate proxies or by browsers.
Private:-means the data is private cannot be cached by intermediate proxies,
it is stored only in users browsers and used by default in HTTP authentication response.

Example working:- 

http://www.example.com/abc/xyz

First time:-

cache control=no-cache

now try to access same url  http://www.example.com/thisistest

second time:-

cache control=max age=12345678 (10years)

expires=dd/mm/yy hh:mm:ss  

Note:- Max age will override than expire header.

============================================
GET POST HEAD
POST /foo.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 (.NET CLR 3.5.30729)
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://localhost/test.php  ===>referal URL
Content-Type: application/x-www-form-urlencoded
Content-Length: 43 ==================>know in advanced the size of the content it will need to reserve

                                                                             space for.
=======================================================
HTTP-RESPONSE
    HTTP/1.1 200 OK\r\n
    Date: Tue, 13 Jun 2017 12:31:49 GMT\r\n
    Server: Apache\r\n
    Expires: Thu, 19 Nov 1981 08:52:00 GMT\r\n
    Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\n
    Pragma: no-cache\r\n
    Set-Cookie: LG=en; expires=Fri, 08-Jun-2018 12:31:49 GMT; path=/; domain=ping.eu\r\n
    Connection: close\r\n
    Transfer-Encoding: chunked\r\n
    Content-Type: text/html; charset=UTF-8\r\n
    \r\n
    [HTTP response 1/1]
    [Time since request: 3.233724000 seconds]
    [Request in frame: 191]
    HTTP chunked response
    File Data: 13511 bytes
Line-based text data: text/html

===========================================================

The HTTP/1.0 specification[11] defined the GET, POST and HEAD methods and the HTTP/1.1 specification[12] added 5 new methods: OPTIONS, PUT, DELETE, TRACE and CONNECT.

GET:-uses URL and used to get all necessary infor/data from the server(commonly used)
POST:-to send data from client to server.(POST /my_data_send.php HTTP/1.1) sending .php
PUT:-to update something in the URI
DELETE:-when you are deleting an existing one.
---
HEAD:-same as GET, but without actual data or page. it is used to get the headers from server.
        (used to save BW to get infor from server)
TRACE:-used to retrieve complete request from server.(used for troubleshooting)
OPTIONS:- used to get to know server capabilities.

            based on that it will modify on client side

=========================

HTTP RESPONSE STATUS CODES:-

1xx:- Informational

2xx:- SUCCESSFUL RESPONSE
200-OK:- successful HTTP response.
201 Created:- response sent after PUT request
202:-request was received but not yet re-acted.
205:-reset the document view.
206:- response contains only partial content, to separate download into multiple content.

3xx- REDIRECTION
301:-resource is allocated with new URL
303:-server sent to client to get requested resource from another URI with GET request.
303:-resource not changed
304- Not Modified :- This tells the browser that the response it has in cache has not changed and can be renewed
                    for another 120 seconds(max-age timer). Note that we do not have to download the response once more - this saves time and bandwidth.

                    
4xx--->CLIENT ERRORS
400 bad request:- req was malformed meanse some headers are missing in initial request.
401 Unauthorizd:-username/password login issue
403 Forbidden:- permission issue like some folder, no access.
404 not found:-  because you typed the URL in wrong or the page has been moved or removed from the website and
                you should have known
408- Request Timeout:- The 408 Request Timeout error is a common error message on very popular websites when a
                        huge increase in traffic by visitors (that's you!) is overwhelming the servers. As more and more visitors leave the website, the chances of a successful page load for you increases.

                        
5xx SERVER ERRORS:-
501 not Implemented:- server doest not support the request.
502-Bad Gateway Error:-network error between servers on the Internet. The server encountered a temporary error
                        and could not complete your request.
503 service unavailable:- high CPU or when server wont respond
504-Gateway Timeout:-means that one server did not receive a timely response from another server that it was
                    accessing while attempting to load the web page or fill another request by the browser.
                    means that whatever other server is taking so long that it's "timing out" is probably down or not working properly.

More:-

SSL= Cryptography

symmetric encryption==uses public key for encryption and decryption
asymmetric encryption=uses public key for encryption private key to decrypt the data

working:
www.google.com
destination port=443

destination protocol=TCP

BROWSER--------------------SERVER