How the web works: HTTP, DNS, TLS
HTTP, browsers, servers, DNS and cookies.
Level 101 · 17 lessons · 15 practice labs
Lessons
Requests and responses
- Anatomy of a URL: You will recognise the parts of a web address, such as protocol, domain, path and parameters, and say what each one does.
- What happens when you press Enter
- An HTTP request and response: You will read, part by part, the request a browser sends to a server and the response the server gives back.
- HTTP methods: GET, POST and friends
- Status codes and headers: You will read what status codes such as 200, 404 and 500 and the headers tell you, and guess where a problem lies.
- Redirects: 301, 302 and curl -L
- Short task: dissect a page’s response
Names and connections
- DNS and the journey of a request: You will follow step by step how DNS turns a typed address into an IP address and how the request then reaches the server.
- IP addresses, ports and the TCP connection
- HTTPS and TLS: You will understand how HTTPS and TLS encrypt traffic and check that the server on the other end is genuine.
- Inspecting a certificate: whose it is and until when
- Short task: trace a domain name end to end
The browser and state
- How a browser draws a page: You will understand how a browser takes the incoming HTML, CSS and scripts and turns them into the page on screen.
- How many files make up a page
- Cookies and sessions: You will understand how cookies and sessions let a site recognise you again, and why that information must be protected.
- Client side and server side
- Capstone: follow a request with curl: You send a request to a fictional company's test site with curl and record the address, redirects, status code and headers step by step.
Practice labs
- Split a URL into its parts: Find the scheme, host, path, query parameters and fragment in Kumsal Bookshop's campaign link.
- Repair a badly encoded link: Mavikuş Cargo's tracking link has spaces and Turkish letters encoded wrongly; fix the percent-encoding so it works.
- Untangle a deceptive URL: Prove with curl which server a link with an @ sign and nested subdomains sent to a Defne Insurance employee really reaches.
- Read a page's status and type: Send curl -I to Lale Florist's home page and note the status code, content type and server header.
- Find where a vanished page moved: An old campaign URL redirects in a chain; follow each hop with curl -L and -v and list the final address and codes.
- Classify the responses of five URLs: For five randomly chosen URLs, record the method, status code and redirect target and write a short table.
- Find a domain's IP address: Ask the local resolver for the lab bazaar site's A record and its TTL.
- Fix a name pointing at the wrong server: Poyraz Travel's site shows the old server; compare /etc/hosts with the DNS answer and fix the source of the problem.
- Map every record of a name: Collect the A, AAAA, CNAME, MX and TXT records of the lab domain with dig and sketch which service runs where.
- Find when a certificate expires: Connect to the lab site with openssl s_client and write down who the certificate is issued to and its last valid day.
- Explain a name mismatch warning: The browser warns on Kuzey Pharmacy's site; inspect the certificate's alternative names and find which name is missing.
- Find the break in a certificate chain: curl reports a verification error; walk the chain step by step, spot the missing intermediate and assemble the right chain.
- List the cookies a site sets: Request the login page, read the Set-Cookie headers and note each cookie's name, lifetime and path.
- Keep a session alive with curl: Log in to Ilgaz Market's demo account using a cookie jar and fetch the cart page while still signed in.
- Server side or client side?: Show with evidence which of a page's price, username and clock values are produced on the server and which in the browser.
About this course
HTTP, browsers, servers, DNS and cookies.
What you will learn
- Requests and responses
- Names and connections
- The browser and state
Prerequisites
No prior knowledge is needed; the course starts from zero.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at beginner level; every term is explained where it first appears.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.