HTTP and TLS in depth: HTTP/2, QUIC, TLS 1.3
You decode three generations of HTTP and the TLS handshake at packet level, read certificates and decrypt your own lab traffic with a key log.
Level 301 · 16 lessons · 15 practice labs
Lessons
HTTP generations
- HTTP/1.1 on the wire: keep-alive and chunked transfer
- HTTP/2 frames and streams: HEADERS, DATA, SETTINGS
- QUIC and HTTP/3: encrypted transport over UDP
- Proxies and CONNECT: who is really talking to whom
- Short task: compare captures of one page over three HTTP versions
The TLS handshake
- The TLS 1.2 handshake step by step
- TLS 1.3: one round trip and encrypted certificates
- Cipher suites and extensions: what counts as weak
- Interpreting TLS alerts and failed handshakes
- Short task: show with packets why an HTTPS connection failed
Certificates and decryption
- The certificate chain, validity and subject alternative names
- Spotting self-signed and odd certificates
- Decrypting your own lab traffic with SSLKEYLOGFILE
- Rebuilding a request in a decrypted HTTP/2 stream
- Short task: list the expired and self-signed certificates in a capture
- Capstone: prove a data leak inside an encrypted web session
Practice labs
- Inspect an HTTP/1.1 persistent connection: Count the requests carried on one TCP connection and show the response using chunked transfer.
- Sort HTTP/2 frames into streams: Group the HEADERS, DATA and SETTINGS frames by stream number in a decrypted capture.
- Compare three versions of the same page: Compare the connection count, round trips and visible fields in HTTP/1.1, HTTP/2 and HTTP/3 captures of the same page.
- Find the CONNECT request: Filter the CONNECT requests in a proxy capture and list the target host names.
- Who talks to whom behind the proxy: Match the two separate connections between client, proxy and target and write the real endpoints.
- Visible fields in a QUIC handshake: Extract the version, connection ids and server name from QUIC initial packets and state which parts stay encrypted.
- Step through a TLS 1.2 handshake: List every message of a TLS 1.2 handshake in order with packet numbers.
- Show the difference between TLS 1.2 and 1.3: Compare two handshakes and show the round-trip count and where the certificate becomes encrypted.
- The cause of a failed HTTPS connection: Find the TLS alert in three failed handshakes and classify the cause as version, cipher suite or certificate.
- Read a certificate chain: Extract the subject, issuer, validity and alternative names of the certificates in a handshake.
- List the expired and self-signed ones: Scan every server certificate in a capture and list the expired and self-signed ones by server name.
- Audit weak cipher suites: Count the negotiated cipher suites in the Yelkovan Bankası lab network capture and report the weak ones with their servers.
- Decrypt with a key log: Load the SSLKEYLOGFILE into Wireshark and read the first HTTP request of your own lab session.
- Rebuild a decrypted HTTP/2 request: Rebuild the headers and body of a form submission in the decrypted stream.
- Prove a data leak in an encrypted session: Using the key log of a lab browser session, show with packets which request sent which data out.
About this course
You decode three generations of HTTP and the TLS handshake at packet level, read certificates and decrypt your own lab traffic with a key log.
What you will learn
- HTTP generations
- The TLS handshake
- Certificates and decryption
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.