Now, before we dig any deeper into how to exploit and discover vulnerabilities, I'd like to pause
and just go back for a second and see what exactly happens when a user clicks on a certain link.
So we have here we have the client side.
So this is your the computer with the HTML website that is displayed to the user.
So this, this is all loaded on your computer on the client.
And then we have the server which contains the code that gets executed if the website is functional
and if it uses code.
So when you click on a link.
The HTML website or the client side, part of the page of the website will generate a request so it
won't actually do any computations most of the time.
Now sometimes there is client site code and we'll see that, but usually the client site code will generate
a request which is sent to the website, to the web server.
At the web server you'll have some functional code such as PHP or Python, Ruby, any programming language.
And that's most of the time that code interacts with the database, gets some sort of information,
and then send the information as a response to the website, to the browser, and the browser will display
it as HTML.
So the code, the functional code or the computation code is usually stored at the server side.
And the way that most of these websites work is they generate a request, they send it to the server,
the server, execute the request and send it back.
So when we're trying to hack into websites and exploit them, we usually play with the request sent
and try to modify that request so that it performs some actions that would help us to gain information
or run some certain type of code that will give us reverse connection.
Now there are two types of requests.
There is get requests and post requests.
Let's have an example.
So if we go here on the file inclusion, you'll see that we have a variable called page and the value
of that is include the PHP.
So right here, this is a get request because we can see the values of it in the URL.
So we can see that page equals include the PHP.
So this page is requesting another page to include another page called index dot php.
Now we won't go into detail of what that means.
All we're concerned about is to have an example, and this is the example.
So this is the variable that we're giving a value for, which is page and we're giving it a value of
include dot PHP.
So that's a getter request.
An example of a post request is the file upload.
So if we go to the file upload when you upload something in here.
So let me just upload something.
You'll see that the URL doesn't get modified, but the request is sent.
So the web, the image is actually uploaded on the server and all that, but the URL still looks the
same.
But the website did send information, so the HTML website did send information to the server.
You just didn't see the information in here because it was sent as host instead of get.
So.
The first problem now is we can't see the post requests, we can't modify them because they're not shown
here in the in the URL.
In the case of get, we can modify them straight away from the URL.
Another problem is a lot of these websites in the future, they're are going to be used in security
and they're going to be used in client side code.
So if that's used, then the request is actually modified before it gets sent.
So there will be filters and stuff working on the client side that will modify our code before we send
it.
So the best way of intercepting requests and so that we can see the post requests, we're going to use
a proxy.
The proxy that we're going to be using is birth proxy.
So how burp is going to work is we have our client here and we have the web server just like we seen
it before and we have the HTML website loaded on our machine.
So when we send the request and instead, instead of sending it directly to the web browser, we're
actually going to configure our browser to send the request to burp.
So this is our proxy running here.
Burp will see all the parameters that are being posted to the website.
So we're going to see the post requests, the Get requests, and we'll see them after all the client
code has been applied.
So some websites apply the client side code, as I said to the request before they send it.
So we're going to be able to see the requests after the client side code has been applied.
This is very important because a lot of websites use filtering as client side and then we'll be able
to bypass all of these filters by intercepting the request.
Then once we modify the request in burp, we're going to forward it to the website.
The website will execute it and give it back to us.
All of this will become clearer in the next lecture as we use burp proxy in practice to intercept and
modify requests.