Special topics in cybersecurity
Computer science / Cybersecurity
Topic 02
DNS, HTTP
What happens when you type a URL and press
enter?
2
Domain Name System (DNS)
• The Domain Name System is a hierarchical and distributed name
service that provides a naming system for computers, services,
and other resources on the Internet or other Internet Protocol
networks. It associates various information with domain names
assigned to each of the associated entities
3
DNS
[Link]
[Link]
4
How does the "DNS server" work?
Root Nameserver
[Link]
[Link]? “.com”
Nameserver
See “[Link]” NS
[Link]
“[Link]”
Nameserver
5
What happens when you type a URL and press
enter?
1. Client asks DNS Recursive Resolver to lookup a hostname ([Link]).
2. DNS Recursive Resolver sends DNS query to Root Nameserver
• Root Nameserver responds with IP address of TLD Nameserver (".com" Nameserver)
3. DNS Recursive Resolver sends DNS query to TLD Nameserver
• TLD Nameserver responds with IP address of Domain Nameserver (“[Link]"
Nameserver)
4. DNS Recursive Resolver sends DNS query to Domain Nameserver
• Domain Nameserver is authoritative, so replies with server IP address.
5. DNS Recursive Resolver finally responds to Client, sending server IP
address ([Link])
6
DNS + HTTP
DNS
Recursive
Resolver
HTTP Request
Client Server
[Link]
HTTP Response
7
Attacks on DNS ?
………………………………………………………
8
DNS hijacking
• Attacker changes target DNS record to point to attacker IP address
• Causes all site visitors to be directed to attacker's web server
• Motivation
• Phishing
• Revenue through ads, cryptocurrency mining, etc.
• How do they do it?
9
DNS hijacking
Hijacked
DNS
Resolver
Malicious
Server
[Link]
Client
Server
[Link]
10
DNS hijacking vectors
• Hijacked recursive DNS resolver (shown previously)
• Hijacked DNS nameserver
• Compromised user account at DNS provider
• Malware changes user's local DNS settings
• Hijacked router
11
12
DNS privacy
• Queries are in plaintext
• ISPs have been known to sell this data
• Pro tip: Consider switching your DNS settings to [Link] or
another provider with a good privacy policy
13
14
HTTP
What
happens
when you
…
type a URL
and press
enter?
15
HTTP
Request
Client Server
Response
16
Demo: Make an HTTP request
curl [Link]
curl [Link] > [Link]
open [Link]
17
HTTP request
GET / H T T P / 1 . 1
Host: [Link]
User-Agent: Mozilla/5.0 . . .
18
HTTP response
HTTP/1.1 200 OK
Content-Length: 9001
Content-Type: text/html; charset=UTF-8
Date: Tue, 24 Sep 2019 20:30:00 GMT
<!DOCTYPE html ...
19
HTTP
• Client-server model - Client asks server for resource, server
replies
• Simple - Human-readable text protocol
• Extensible - Just add HTTP headers
• Transport protocol agnostic - Only requirement is reliability
• Stateless - Two requests have no relation to each other
20
HTTP is stateless?
• Obviously, we interact with "stateful" servers all the time
• "Stateless" means the HTTP protocol itself does not store state
• If state is desired, is implemented as a layer on top of HTTP
21
HTTP Status Codes
• 1xx - Informational ("Hold on")
• 2xx - Success ("Here you go")
• 3xx - Redirection ("Go away")
• 4xx - Client error ("You messed up")
• 5xx - Server error ("I messed up")
22
HTTP Success Codes
• 200 OK - Request succeeded
• 206 Partial Content - Request for specific byte range succeeded
23
Range Request
GET /video.mp4
HTTP/1.1 Range:
bytes=1000-1499
Response
HTTP/1.1 206 Partial Content
Content-Range: bytes 1000-1499/1000000
24
HTTP Redirection Codes
• 301 Moved Permanently - Resource has a new permanent URL
• 302 Found - Resource temporarily resides at a different URL
• 304 Not Modified - Resource has not been modified since last
cached
25
HTTP Client Error Codes
• 400 Bad Request - Malformed request
• 401 Unauthorized - Resource is protected, need to authorize
• 403 Forbidden - Resource is protected, denying access
• 404 Not Found - Ya'll know this one
26
HTTP Server Error Codes
• 500 Internal Server Error - Generic server error
• 502 Bad Gateway - Server is a proxy; backend server is
unreachable
• 503 Service Unavailable - Server is overloaded or down for
maintenance
• 504 Gateway Timeout - Server is a proxy; backend server
responded too slowly
27
HTTP with a proxy server
Request Request
Client Proxy Server
Response Response
28
HTTP proxy servers
• Can cache content
• Can block content (e.g. malware, adult content)
• Can modify content
• Can sit in front of many servers ("reverse proxy")
29
HTTP request (…)
GET / H T T P / 1 . 1
Host: [Link]
User-Agent: Mozilla/5.0 . . .
30
HTTP headers
• Let the client and the server pass additional information with an
HTTP request or response
• Essentially a map of key-value pairs
• Allow experimental extensions to HTTP without requiring protocol
changes
31
Useful HTTP request headers
• Host - The domain name of the server (e.g. [Link])
• User-Agent - The name of your browser and operating system
• Referrer - The webpage which led you to this page (misspelled)
• Cookie - The cookie server gave you earlier; keeps you logged in
• Range - Specifies a subset of bytes to fetch
32
Useful HTTP request headers (…)
• Cache-Control - Specifies if you want a cached response or not
• If-Modified-Since - Only send resource if it changed recently
• Connection - Control TCP socket (e.g. keep-alive or close)
• Accept - Which type of content we want (e.g. text/html)
• Accept-Encoding - Encoding algorithms we understand (e.g.
compress (algorithm/s))
• Accept-Language - What language we want (e.g. es)
33
Make an HTTP request with headers
curl [Link] --header "Accept-Language: es" --silent | grep JavaScript
curl [Link] --header "Accept-Language: ar" --silent | grep JavaScript
34
Useful HTTP response headers (…)
• Date - When response was sent
• Last-Modified - When content was last modified
• Cache-Control - Specifies whether to cache response or not
• Expires - Discard response from cache after this date
• Set-Cookie - Set a cookie on the client
• Vary - List of headers which affect response; used by cache
35
Useful HTTP response headers (…)
• Location - URL to redirect the client to (used with 3xx responses)
• Connection - Control TCP socket (e.g. keep-alive or close)
• Content-Type - Type of content in response (e.g. text/html)
• Content-Encoding - Encoding of the response (e.g. gzip)
• Content-Language - Language of the response (e.g. ar)
• Content-Length - Length of the response in bytes
36
37
Demo: Implement an HTTP client
• Not magic!
• Steps:
• Open a TCP socket
• Send HTTP request text over the socket
• Read the HTTP response text from the socket
38
Demo: Implement an HTTP client
import socket
sock = socket.create_connection(('[Link]', 80))
request = b"GET / HTTP/1.1\r\nHost: [Link]\r\n\r\n"
[Link](request)
while True:
data = [Link](4096)
if not data:
break
print([Link](), end='')
[Link]()
39
What happens when you type a URL and press
enter?
1. Perform a DNS lookup on the hostname ([Link]) to get an IP address
([Link])
2. Open a TCP socket to [Link] on port 80 (the HTTP port)
3. Send an HTTP request that includes the desired path (/)
4. Read the HTTP response from the socket
5. Parse the HTML into the DOM
6. Render the page based on the DOM
7. Repeat until all external resources are loaded:
• If there are pending external resources, make HTTP requests for these (run steps 1-4)
• Render the resources into the page
40
[Link] DNS Recursive NS
NS
Resolver NS
[Link]
GET /
200 OK, <!doctype html …
Client GET /[Link]
GET /[Link]
Server
200 OK, body { color: blue; }
200 OK, <binary image data>
[Link]
41
Self-study
• Reading
• An overview of HTTP
[Link]
• A typical HTTP session
[Link]
• HTTP headers
[Link]
42