2. Ports and Protocols: SSH, HTTP, HTTPS, FTP/SFTP and DNS
2.3 HTTP – Port 80
HTTP ha web cha bhasha aahe. Browser request pathavto, server response deto. Burp Suite shiktana (Part 10) tumhi hech requests pakdun badlnar aahat, mhanun structure nit samja.
GET /login.php?next=/profile HTTP/1.1 <- method, path + query, version
Host: shop.example.com <- which website (virtual host)
User-Agent: Mozilla/5.0 ...
Cookie: PHPSESSID=8f2c1a... <- session identifier
<- blank line, then optional body
HTTP/1.1 200 OK <- status line
Content-Type: text/html; charset=UTF-8
Set-Cookie: PHPSESSID=8f2c1a...; HttpOnly
<html> ... </html>
| Method | Meaning | Typical use |
|---|---|---|
| GET | Read a resource; parameters in the URL | Open a page, search |
| POST | Send data in the body | Login form, upload |
| PUT / PATCH | Replace / update a resource | REST APIs |
| DELETE | Delete a resource | REST APIs |
| HEAD | Like GET but headers only | curl -I |
| OPTIONS | Which methods are allowed | CORS pre-flight |
| Status class | Meaning | Examples |
|---|---|---|
| 1xx | Informational | 101 Switching Protocols |
| 2xx | Success | 200 OK, 201 Created, 204 No Content |
| 3xx | Redirect | 301 Moved Permanently, 302 Found, 304 Not Modified |
| 4xx | Client error | 400 Bad Request, 401 Unauthorized, 403 Forbidden, 404 Not Found |
| 5xx | Server error | 500 Internal Server Error, 502 Bad Gateway, 503 Service Unavailable |
curl -I http://example.com # only headers
curl -v http://example.com # full request and response
Why this matters for security
Plain HTTP is readable by anyone on the path (Wi-Fi, ISP, a compromised router) – passwords and cookies travel in clear text. HTTP is also stateless, so applications use cookies/sessions; stealing a session cookie (for example through XSS) means logging in as the victim. Almost every web attack in the OWASP Top 10 is a manipulated HTTP request.
Ravindra Bagale's Tip
Many students get confused between 401 and 403. 401 means "I don't know who you are – please log in" (authentication); 403 means "I know who you are, but you don't have permission" (authorization). Interviewers often ask about this difference – very simple, but remember it.
Ravindra Bagale's Tip – मराठी
401 आणि 403 मध्ये बरेच students गोंधळतात. 401 म्हणजे "तुम्ही कोण आहात हे मला माहीत नाही – login करा" (authentication), 403 म्हणजे "तुम्ही कोण आहात हे माहीत आहे, पण परवानगी नाही" (authorization). Interview मध्ये हा फरक नक्की विचारतात – एकदम simple, पण लक्षात ठेवा.
Ravindra Bagale's Tip – हिंदी
401 और 403 में बहुत से students उलझ जाते हैं. 401 यानी "तुम कौन हो यह मुझे नहीं पता – login करो" (authentication), 403 यानी "तुम कौन हो यह पता है, पर इजाज़त नहीं है" (authorization). Interview में यह फ़र्क ज़रूर पूछते हैं – बहुत आसान, पर याद रखो.
Practice task
Run curl -v http://example.com -o /dev/null and identify: the request line, the Host header, the status code and two response headers.