Essential Concepts - Types of Proxy Server

Before reading this article, I suggest you to read my previous article on What is a proxy and How the proxy works. Here, we will see the different types of proxy used in daily life.

Proxies are defined into different categories based on the level of anonymity and functions it provides.

You may see references to four different types of proxy servers:

• Transparent Proxy

  This type of proxy server identifies itself as a proxy server and also makes the original IP address available through the http headers. These are generally used for their ability to cache websites and do not provide any anonymity to those who use them. However, the use of a transparent proxy will get you around simple IP bans. They are transparent in the terms that your IP address is exposed, not transparent in the terms that you do not know that you are using it (your system is not specifically configured to use it.)

• Anonymous Proxy

  This type of proxy server identifies itself as a proxy server, but does not make the original IP address available. This type of proxy server is detectable, but provides reasonable anonymity for most users.

• Distorting Proxy

  This type of proxy server identifies itself as a proxy server, but make an incorrect original IP address available through the http headers.

• High Anonymity Proxy

  This type of proxy server does not identify itself as a proxy server and does not make available the original IP address.

Read More

Essential Concepts - Proxy Server

The concept of proxy is similar to the concept of firewall but it differs by its use. Both are a part of Network Security. So I recommend you to read my post on Firewall before you start understanding proxy.

In a computer network, a proxy server is any computer system offering a service that acts as an intermediary between the two communicating parties, the client and the server. A proxy server is a computer that offers a computer network service to allow clients to make indirect network connections to other network services.

How Proxy Server works?

In the presence of a proxy server, there is no direct communication between the client and the server. Instead, the client connects to the proxy server and sends requests for resources such as a document, web page or a file that resides on a remote server.

A common proxy application is a caching Web proxy. This provides a nearby cache of Web pages and files available on remote Web servers, allowing local network clients to access them more quickly or reliably.

When it receives a request for a Web resource (specified by a URL), a caching proxy looks for the resulting URL in its local cache. If found, it returns the document immediately. Otherwise it fetches it from the remote server, returns it to the requester and saves a copy in the cache. The cache usually uses an expiry algorithm to remove documents from the cache, according to their age, size, and access history.

As shown in the above example, whenever the client connects to a web proxy server and makes a request for the resources (in this case, “Sample.html”) that reside on a remote server (in this case, xyz.com), the proxy server forwards this request to the target server on behalf of the client so as to fetch the requested resource and deliver it back to the client. An example of client can be a user operated computer that is connected to the Internet.

Functions of a proxy server :

Proxy servers are used for many different purposes depending on its function

• A proxy server is most widely used to conceal the IP address or the origin of the Internet users during their activity. Since it the proxy server which handles the requests between the client and the target, only the IP address of the proxy server is exposed to the outside world and not the actual one. Therefore, most hackers use a proxy server during the attacks on their target so that it would be hard to trace back to them. 
• Proxies may also cache web pages. Each time an internal user requests a URL from outside, a temporary copy is stored locally. The next time an internal user requests the same URL, the proxy can serve the local copy instead of retrieving the original across the network, improving performance.
• Web proxies can also filter the content of Web pages served. Some censorware applications - which attempt to block offensive Web content - are implemented as Web proxies.
• Web proxies can also reformat web pages for a specific purpose or audience; for example, Opera mini (browser uses its own proxy server) reformats web pages for mobile devices in order to provide faster speed.
• A special case of web proxies are "CGI proxies." These are web sites which allow a user to access a site through them. CGI proxies are frequently used to gain access to web sites blocked by corporate or school proxies. Since they also hide the user's own IP address from the web sites they access through the proxy, they are sometimes also used to gain a degree of anonymity.

Read More

Essential Concepts - Firewall

We have covered most of the concepts of networking. But still some of the concepts are left over. They include Firewall and Proxies. Generally, we may face situations where some site is blocked, or sometimes we require authentication (username and password) to use internet. Also sometimes, some of the apps or software installed on our are blocked to use our internet connection. All these things are done via Firewall and its set of rules.

A firewall is a network security system, either hardware- or software-based, that uses rules to control incoming and outgoing network traffic. Firewalls are basically a barrier between your computer (or a network) and the Internet (outside world). A firewall can be simply compared to a security guard who stands at the entrance of your house and filters the visitors coming to your place. He may allow some visitors to enter while deny others whom he suspects of being intruders. Similarly a firewall is a software program or a hardware device that filters the information (packets) coming through the Internet to your personal computer or a computer network.

How a Firewall works?

Firewalls may decide to allow or block network traffic between devices based on the rules that are pre-configured or set by the firewall administrator. Most personal firewalls such as Windows firewall operate on a set of pre-configured rules which are most suitable under normal circumstances, so that the user need not worry much about configuring the firewall.

Personal firewalls are easy to install and use and hence preferred by end-users to secure their personal computers. However, in order to meet customized needs large networks and companies prefer those firewalls that have plenty of options to configure.

For example, a company can set up rules like this for FTP servers, Web servers, Telnet servers and so on. In addition, the company can control how employees connect to Web sites, whether files are allowed to leave the company over the network and so on. Thus, in addition to security, a firewall gives a company tremendous control over how people use the network.

Firewalls use one or more of three methods to control traffic flowing in and out of the network:

• Packet filtering - Packets (small chunks of data) are analyzed against a set of filters. Packet filters has a set of rules that come with accept and deny actions which are pre-configured or can be configured manually by the firewall administrator. Packets that make it through the filters are sent to the requesting system and all others are discarded.
• Stateful inspection - A newer method that doesn't examine the contents of each packet. Instead compares certain key parts of the packet to a database of trusted information. Both incoming and outgoing packets are compared against this database. If the comparison yields a reasonable match, the information is allowed through. Otherwise it is discarded.

Firewall configuration :

Firewalls are customizable. This means that you can add or remove filters based on several conditions. Some of these are:

• IP addresses - Each machine on the Internet is assigned a unique address called an IP address. In any case, if an IP address outside the network is said to be unfavourable, then it is possible to set filter to block all the traffic to and from that IP address. For example, If a certain IP address outside the company is reading too many files from a server, the firewall can block all traffic to or from that IP address.
• Domain names - Because it is hard to remember the string of numbers that make up an IP address, and because IP addresses sometimes need to change, all servers on the Internet also have human-readable names, called domain names. For example, it is easier for most of us to remember www.libraryofhacks.blogspot.in than it is to remember 156.17.41.157. Since it is difficult to remember the IP addresses, it is an easier and smarter way to configure the firewalls by adding filters based on domain names. By setting up a domain filter, a company may decide to block all access to certain domain names, or may provide access only to a list of selected domain names.
• Ports/Protocols - Open ports (which are online - can receive/send data) are like open door of our house which can lead to theft. If the services running on a given port is intended for the public or network users, they are usually kept open. Otherwise they are blocked using the firewall so as to prevent intruders from using the open ports for making unauthorized connections.
• Specific words and phrases - A firewall can be configured to filter one or more specific words or phrases so that both the incoming and outgoing packets are scanned for the words in the filter. This can be anything. The firewall will sniff (search through) each packet of information for an exact match of the text listed in the filter. For example, you could instruct the firewall to block any packet with the word "X-rated" in it. The key here is that it has to be an exact match. The "X-rated" filter would not catch "X rated" (no hyphen). But you can include as many words, phrases and variations of them as you need.

Real-time examples :

• IP addresses/Domain names - Torrent websites blocked on our college internet network.
• Ports/Protocols - Internet connection which supports surfing, but does not support downloading. (Because the FTP port of the system in closed.)
• Specific words and phrases - Filter any packet that contains an offensive term or a phrase that you may decide to block from entering or leaving your network.

Hardware vs. Software Firewall :

Hardware firewalls provide higher level of security and hence preferred for servers where security has the top most priority. The software firewalls on the other hand are less expensive and hence preferred in home computers and laptops.

Hardware firewalls usually come as an in-built unit of a router and provide maximum security as it filters each packet at the hardware level itself even before it manages to enter your computer. A good example is the Linksys Cable/DSL router.

In hardware firewalls, the firewall system in managed in the router itself. Hence, when any computer with weak/no firewall system connects to the router, it can safely surf the internet. It is because the incoming packets are filtered at the router itself i.e. before entering your computer system.

Read More

Essential Concepts - Domain Name System (DNS)

In my previous tutorials, I have mentioned that each device connected to the internet has its own IP Address so that it can be uniquely identified. For devices connecting to internet, the IP address is provided by the ISPs. But here the question arise is -- Who is providing IP or range of IPs to the ISP?

Also a similar question arise is -- Who is providing specific IP to the Hosted Website? 

Let us take an example of facebook.com. We know that every server is identified by a unique IP. That means that facebook would also have its own IP. Who provided this IP to facebook?

You will get the answers to these questions in this tutorial.

Domain Name System (DNS) 

First, we will understand the term 'Domain Name'. Domain name is the name of the server hosting any number of websites. In example of facebook, facebook.com is a domain name as it is hosting a single website. In my case, i.e. libraryofhacks.blogspot.in , domain name is blogspot.com or blogger.com as it is hosting my website including many other websites too.

Domain names are used to identify one or more IP addresses. For example, the domain name microsoft.com represents about a dozen IP addresses. Domain names are used in URLs to identify particular Web pages.

The Domain Name System is a system which maps (translates) a host name into a particular IP Address.

Why to use DNS?

Since Internet is the mother of millions of computers each having a unique IP address, it becomes impossible for people to remember the IP address of each and every computer they want to access. So, in order to make this process simpler the concept of domain names was introduced. As a result users can easily access any website just by typing their domain names in the browser’s address bas such as “google.com” or “yahoo.com” without having to remember their actual IP addresses. 

However, since the network protocol understands only the IP address and not the domain names, it is necessary to translate the domain name back to its corresponding IP address before establishing a connection with the target server. This is where DNS comes in handy.

Your Internet Service Provider has a DNS server which maintains a huge record of existing domain names and their corresponding IP addresses. Each time you type the URL such as “http://www.google.com” on your browser’s address bar, your computer will use the DNS server from the ISP and translates the domain name “google.com” to its corresponding IP address to make a connection with the Google’s server. All this process will happen in a split second behind the scenes and hence goes unnoticed.

Concept Of Domain Name System (DNS) Server

The internet uses DNS (Domain Name System) records to translate host names into IP addresses (in this case 193.202.110.175) and in some cases vice versa too.

When you type the DNS of a website into your browser (which I would hope is Chrome, Firefox or Opera, and not IE) it begins looking up the host. This can be seen when your internet connection is slow. We know that when we surf on internet using any of the browsers mentioned above, we can see the status of connection at bottom-left/right corner. Now when your internet slows down, you will be able to see each and every status of the connection. The first one of it would be 'looking up the host'. This means that the browser is looking DNS servers for the host (Domain Name) you specified in the URL.

How DNS Works? 

 

Click to view full size image

Whenever you type a URL such as “https://libraryofhacks.com” (doesn't exist now as I haven't bought my Professional Domain) on your browser’s address bar, your computer will send a request to the local name server (the ISP DNS server) to resolve the domain name to its corresponding IP address. This request is often referred to as a DNS query.

The local name server will receive the query to find out whether it contains the matching name and IP address in its database. If found, the corresponding IP address (response) is returned. If not, the query is automatically passed on to another DNS server that is in the next higher level of DNS hierarchy. This process continues until the query reaches the DNS server that contains the matching name and IP address. The IP address (response) then flows back the chain in the reverse order to your computer.

Read More

Essential Concepts - Network Packets

We have seen the topics that gives us the answers of the below questions :

• How a server is uniquely identified? -- IP Address
• What are the services provided between two servers? -- Protocols
• How to connect for a specific service? -- Ports

There are many other questions, one of which is : How the data is being transferred between two servers?

Consider that you have to transfer a PPT containing 15 slides froam a server to another. But the bandwidth is only of 5 slides. Now you divide the PPT into 3 PPTs each containing 5 slides and transfer them in a sequence. Also these PPTs are received in the same sequence at the receiving end and then combined to form the final PPT. Here, each PPT is called a packet and the final PPT is called data.

Packets and Packet Switching :

It turns out that everything you do on the Internet involves packets. For example, every Web page that you receive comes as a series of packets, and every e-mail you send leaves as a series of packets. Networks that ship data around in small packets are called packet switched networks. Packet is nothing but a part of divided data.

Packet switching is a digital networking communications method that groups all transmitted data into suitably sized blocks, called packets, which are transmitted via a medium that may be shared by multiple simultaneous communication sessions. Packet switching increases network efficiency, robustness and enables technological convergence of many applications operating on the same network.

A network packet (data packet, datagram or simply called as packet) is a basic unit of data sent from one host to another over a network. When data (such as a mail, message or a file) has to be transmitted between two hosts, it is fragmented into small structures called packets and are reassembled at the destination to make the original data chunk.

On the Internet, the network breaks an e-mail message into parts of a certain size in bytes. These are the packets. Each packet carries the information that will help it get to its destination -- the sender's IP address, the intended receiver's IP address, something that tells the network how many packets this e-mail message has been broken into and the number of this particular packet. The packets carry the data in the protocols that the Internet uses: Transmission Control Protocol/Internet Protocol (TCP/IP). Each packet contains part of the body of your message. A typical packet contains perhaps 1,000 or 1,500 bytes.

Each packet is then sent off to its destination by the best available route -- a route that might be taken by all the other packets in the message or by none of the other packets in the message. This makes the network more efficient. In short, all the packets travels through a common route in a sequence.

Parts of a single packet :

Most network packets are split into three parts :-

Header - The header contains instructions about the data carried by the packet. These instructions may include:

• Length of packet (some networks have fixed-length packets, while others rely on the header to contain this information)
• Synchronization (a few bits that help the packet match up to the network)
• Packet number (which packet this is in a sequence of packets)
• Protocol (on networks that carry multiple types of information, the protocol defines what type of packet is being transmitted: e-mail, Web page, streaming video)
• Destination address (where the packet is going)
• Originating address (where the packet came from)

Payload - Also called the body or data of a packet. This is the actual data that the packet is delivering to the destination. If a packet is fixed-length, then the payload may be padded with blank information to make it the right size.

 

Trailer - The trailer, sometimes called the footer, typically contains a couple of bits that tell the receiving device that it has reached the end of the packet. It may also have some type of error checking.

The most common error checking used in packets is Cyclic Redundancy Check (CRC). CRC is pretty neat. Here is how it works in certain computer networks: It takes the sum of all the 1s in the payload and adds them together. The result is stored as a hexadecimal value in the trailer. The receiving device adds up the 1s in the payload and compares the result to the value stored in the trailer. If the values match, the packet is good. But if the values do not match, the receiving device sends a request to the originating device to resend the packet.

­As an example, let's look at how an e-mail message might get broken into packets. Let's say that you send an e-mail to a friend. The e-mail is about 3,500 bits (3.5 kilobits) in size. The network you send it over uses fixed-length packets of 1,024 bits (1 kilobit). Let. The header of each packet is 96 bits long and the trailer is 32 bits long, leaving 896 bits for the payload. To break the 3,500 bits of message into packets, you will need four packets (divide 3,500 by 896). Three packets will contain 896 bits of payload and the fourth will have 812 bits. Here is what one of the four packets would contain:

• Each packet's header will contain the proper protocols, the originating address (the IP address of your computer), the destination address (the IP address of the computer where you are sending the e-mail) and the packet number (1, 2, 3 or 4 since there are 4 packets).
• Routers in the network will look at the destination address in the header and compare it to their lookup table to find out where to send the packet.
• Once the packet arrives at its destination, your friend's computer will strip the header and trailer off each packet and reassemble the e-mail based on the numbered sequence of the packets.

Read More

Essential Concepts - Network Ports

We have seen the various services used for different purposes like IP, HTTP & FTP, SMTP and Telnet & SSH. But we don't know how to use them or how to connect with a specific service for a specific purpose. To know how to use a specific service, we should know how to connect with the server for that specific service; and to request (connect) for a specific service, we should know its address (where it is located). So, in this article we will study where to find a specific service.

Generally ports are used both in hardware and networking. In hardware, we have LAN port, USB ports, HDMI port and so on. While in networking, we have HTTP port, FTP port, SMTP port an so on. In hardware, the ports are visible and we can touch them; while in networking, ports are only logical concepts using which the server's Internet Protocol Suit is designed.

NOTES : 

• HTTP is a protocol providing a specific service while HTTP Port is the location of that Protocol on the server's IP Suit.
• The Internet protocol suite is the conceptual model and set of communications protocols used on the Internet and similar computer networks. It is commonly known as TCP/IP because the original protocols in the suite are the Transmission Control Protocol (TCP) and the Internet Protocol (IP).

Here, we are going to study the Network Ports as hardware ports are no use in hacking (because they require physical access to the computers).

In the internet protocol suite, a port is an endpoint of communication in an operating system. A port is identified for each address and protocol by a 16-bit number, commonly known as the port number. A port number is a 16-bit unsigned integer, so it ranges from 0 to 65535.

A computer may be running several services on it like HTTP (web server), SMTP, FTP and so on. Each of these services are uniquely identified by a number called network port (or simply referred to as port). If a computer wants to avail a specific service from another computer, it has to establish a connection to it on the exact port number where the intended service is running.

For example, if a terminal is to request a web document from a remote server using HTTP, it has to first establish a connection with the remote server on port 80 (HTTP service runs on port 80) before placing the request.

In simple words, port numbers can be compared to door numbers where each door grants access to a specific service on a computer. The following table shows a list of popular services and their default port numbers: 

• 21    :   File Transfer Protocol (FTP)
• 22    :   Secure Shell (SSH)
• 23    :   Telnet remote login service
• 25    :   Simple Mail Transfer Protocol (SMTP)
• 53    :   Domain Name System (DNS) service
• 80    :   Hypertext Transfer Protocol (HTTP) used in the World Wide Web
• 110  :   Post Office Protocol (POP3)
• 143  :   Internet Message Access Protocol (IMAP)
• 443  :   HTTP Secure (HTTPS)

How to use Port Numbers : 

Network Ports are always associated with IP address and Port number. Suppose that you want to connect to a server (with IP address 192.168.43.1) to transfer a web-document or to browser the website. The protocol used for this service is HTTP or HTTPS (for secure service). Here, the request code would me made in the form as :

192.168.43.1:80       OR       192.168.43.1:443

In general, it would be written as :  IP_Address:Port_Number .

Now you would be thinking, Why we always write 192.168.43.1:33455 in the browser when connecting our Laptop with Mobile via Xender.

Read More

Essential Concepts - Network Protocols (Telnet and SSH)

We have seen the protocols which helps us identify a device uniquely, transfer files between server and client, and help us in E-mail services. But we also use remote connections over internet i.e. control a server from any other device. So here we are going to study the protocol which help us with remote connections.

Telnet :

Telnet is a network protocol that allows you to connect to remote hosts on the internet or on a local network. Telnet is a user command and an underlying TCP/IP protocol for accessing remote computers. Through Telnet, an administrator or another user can access someone else's computer remotely.

On the Web, HTTP and FTP protocols allow you to request specific files from remote computers, but it doesn't allow you to log-in as a user of that computer and control that computer. With Telnet, you log on as a regular user with whatever privileges you may have been granted to the specific application and data on that computer.

A Telnet command request looks like this : 

telnet <hostname or IP> port

Ex : telnet 172.217.6.129   OR   telnet blogspot.in

The result of this request would be an invitation to log on with a userid and a prompt for a password. If accepted, you would be logged on like any user who used this computer every day.

Secure Shell (SSH) :

SSH is a protocol similar to telnet which also facilitates connection to remote hosts for communication. However, SSH has an upper hand over telnet in terms of security.

Telnet was primarily designed to operate within the local network. Local network means computer connected via LAN. One has to access a computer on LAN to steal data or to obtain remote connection. Hence, there was no case of security in Telnet as the attacker needed physical access to computer. But when we use Telnet to get remote connections over Internet, the case of security must be considered. SSH manages to offer total security while connecting to remote hosts on a remote network or Internet.

Hence, SSH, also known as Secure Socket Shell, is a network protocol that provides administrators with a secure way to access a remote computer. Secure Shell provides strong authentication and secure encrypted data communications between two computers connecting over an insecure network such as the Internet.

Read More

Essential Concepts - Network Protocols (SMTP)

So far we have seen Protocols for website communication and file transfer along with security layer. We also use many other services over Internet no-a-days. Take for an example the E-mail service. So today, we are going to study the protocols used in sending and receiving E-mails.

SMTP (Simple Mail transfer Protocol) :

SMTP (Simple Mail Transfer Protocol) is a TCP/IP protocol used in sending and receiving e-mail. However, since it is limited in its ability to queue messages at the receiving end, it is usually used with one of two other protocols, POP3 or IMAP, that let the user save messages in a server mailbox and download them periodically from the server.

Due to its limitation of queuing the mails at receiving end, we can say that :

• The Simple Mail Transfer Protocol provides a standard for sending (not receiving) e-mails from one server to another.

• In other words, users typically use a program that uses SMTP for sending e-mail and either POP3 or IMAP for receiving e-mail.

IMAP (Internet Message Access Protocol) and POP3 (Post Office Protocol 3) :

IMAP (Internet Message Access Protocol) is a standard email protocol that stores email messages on a mail server, but allows the end user to view and manipulate the messages as though they were not stored locally on the end user's computing device(s). This allows users to organize messages into folders, have multiple client applications know which messages have been read, flag messages for urgency or follow-up and save draft messages on the server.

IMAP can be contrasted with another client/server email protocol, Post Office Protocol 3 (POP3). With POP3, mail is saved for the end user in a single mailbox on the server and moved to the end user's device when the mail client opens, i.e. when we open the mailbox, email automatically get downloaded and saved in our device. While POP3 can be thought of as a "store-and-forward" service, IMAP can be thought of as a remote file server (not saved on device but can be accessed online).

Most implementations of IMAP support multiple logins; this allows the end user to simultaneously connect to the email server with different devices. For example, the end user could connect to the mail server with his Gmail app and his Gmail desktop client at the same time. The details for how to handle multiple connections are not specified by the protocol but are instead left to the developers of the mail client.

NOTE : SMTP along with SSL is known as SMPTS.

Read More

Secure Sockets Layer (SSL)

As shown here, the lock icon shows that your connection to the site is secured via SSL. The "info" icon beside the lock can show you the details of the certificate.

The concept of SSL is mainly useful for those Hosting their professional Webservers. For the users, it only matters if the connection is secure, The SSL certificate is provided to a website after its verification by the authorities. The site having SSL secures your data while it is being transmitted from your browser to its server. So, SSL is of huge importance.

What is SSL?

SSL (Secure Sockets Layer) is the standard security technology for establishing an encrypted link between a web server and a browser. This link ensures that all data passed between the web server and browsers remain private and integral. SSL is an industry standard and is used by millions of websites in the protection of their online transactions with their customers.

SSL allows sensitive information such as credit card numbers, social security numbers, and login credentials to be transmitted securely. Normally, data sent between browsers and web servers is sent in plain text—leaving you vulnerable to eavesdropping. If an attacker is able to intercept all data being sent between a browser and a web server, they can see and use that information.

More specifically, SSL is a security protocol. Protocols describe how algorithms should be used. In this case, the SSL protocol determines variables of the encryption for both the link and the data being transmitted.

SSL Certificate 

You might have seen a warning from Chrome or any other browser that "Connection not secured" or "Security certificate expired". Here we add the site to exception list and proceed visiting the site.

To be able to create an SSL connection a web server requires an SSL Certificate. When you choose to activate SSL on your web server you will be prompted to complete a number of questions about the identity of your website and your company. Your web server then creates two cryptographic keys - a Private Key and a Public Key.

The Public Key does not need to be secret and is placed into a Certificate Signing Request (CSR) - a data file also containing your details. You should then submit the CSR. During the SSL Certificate application process, the Certification Authority will validate your details and issue an SSL Certificate containing your details and allowing you to use SSL. Your web server will match your issued SSL Certificate to your Private Key. Your web server will then be able to establish an encrypted link between the website and your customer's web browser.

The complexities of the SSL protocol remain invisible to your customers. Instead their browsers provide them with a key indicator to let them know they are currently protected by an SSL encrypted session - the lock icon, clicking on the lock icon displays your SSL Certificate and the details about it. All SSL Certificates are issued to either companies or legally accountable individuals.

Typically an SSL Certificate will contain your domain name, your company name, your address, your city, your state and your country. It will also contain the expiration date of the Certificate and details of the Certification Authority responsible for the issuance of the Certificate. When a browser connects to a secure site it will retrieve the site's SSL Certificate and check that it has not expired, it has been issued by a Certification Authority the browser trusts, and that it is being used by the website for which it has been issued. If it fails on any one of these checks the browser will display a warning to the end user letting them know that the site is not secured by SSL.

How the SSL (encryption) works?

There are two different keys associated with an SSL certificate - Public key and Private key. Public key, as the name suggests, need not to be hidden while the private key remain hidden with the Server only.

When we establish a connection with an SSL secured web-server, its SSL certificate information is acquired by our web-browser. Along with the information, our browser will also get a public key. The data or request we send from our browser, is encrypted with the help of public key and has the capacity of only being opened by the private key linked to that particular SSL certificate.

Now if anyone get connection in between our browser and server (man-in-the-middle), he/she may get the data which is encrypted. He/she can't decrypt that data as they don't have access to private key. Hence, the user details are protected.

When the encrypted data reaches the server, the server with the help of private key, decrypts that data and the original information is retrieved.

Read More

Essential Concepts - Network Protocols (HTTP & FTP)

Before continuing, I recommend you to read the previous post - Internet Protocols.

Hyper Text Transfer Protocol (HTTP) : 

The Hyper Text Transfer Protocol provides a standard for communication between web browsers and the server. It is one of the most widely used protocol on the Internet for requesting documents such as web pages and images.

Hypertext is structured text that uses logical links (hyperlinks) between nodes (two devices connected) containing text. HTTP is the protocol to exchange or transfer hypertext.

HTTP functions as a request–response protocol in the client–server computing model. A web browser, for example, may be the client and an application running on a computer hosting a website may be the server. The client submits an HTTP request message to the server. The server, which provides resources such as HTML files and other content, or performs other functions on behalf of the client, returns a response message to the client. The response contains completion status information about the request and may also contain requested content in its message body.

(You might be aware of session, authentication and cookies. All these terms are largely used while programming in PHP. But all these terms are HTTP terms. You can Google for information on it as these are easy to understand. Still if you have any doubts, comment below so that I can help you out with a simple article on it.)

HTTP was not designed a secure Protocol. It is vulnerable to Main-in-the-Middle attacks (this topic will be covered later). To overcome it, HTTPS is used now-a-days.

File Transfer Protocol (FTP) :

The File Transfer Protocol provides a standard for transferring files between two computers on the network. FTP is most widely used in carrying out upload/download operations between a server and a workstation.

FTP is built on a client-server model architecture and uses separate control and data connections between the client and the server. FTP users may authenticate themselves with a clear-text sign-in protocol, normally in the form of a username and password, but can connect anonymously if the server is configured to allow it

FTP was not designed to be a secure protocol, and has many security weaknesses. In May 1999, the authors of RFC 2577 listed a vulnerability to the following problems (will be covered in later sessions):

• Brute force attack
• FTP bounce attack
• Packet capture
• Port stealing (guessing the next open port and usurping a legitimate connection)
• Spoofing attack

To overcome the attacks, FTPS is implemented.

NOTE : HTTPS and FTPS are HTTP over SSL and FTP over SSL respectively. (I will write a new article to make you understand what is SSL and its importance.)

What is the difference between FTP and HTTP?

HTTP and FTP are both network protocols for file transfer. HTTP is short for Hyper Text Transfer Protocol, and FTP is short for File Transfer Protocol. Both use TCP (Transmission Control Protocol) to transfer files

The difference between the two is that HTTP is a protocol used by the World Wide Web that allows the transfer of files from a web server to a user’s web browser for viewing web pages on the Internet, while the FTP protocol is used to transfer files from a computer to and from an FTP server. FTP facilitates the transfer of files from one computer to another.

HTTP transfers only web page content to the browser so as to view it. The transferred file is not saved in the memory space. FTP, on the other hand, transfers the whole file to the another computer, and the file is saved in memory. HTTP does not require a password and user name to access the server to transfer files, whereas the FTP protocol requires authentication.

HTTP is faster and more efficient for transferring smaller files, while FTP is faster and more efficient in transferring larger files. HTTP is able to use a single connection to transfer multiple files, while FTP requires a new connection to be created with each file transfer.

Read More

Essential Concepts - IPv4 and IPv6

What are IPv4 and IPv6 ?

IPv4 and IPv6 are two generations of Internet Protocols where IPv4 stands for Internet Protocol version 4 and IPv6 for Internet Protocol version 6. IPv6 is an evolutionary upgrade to the Internet Protocol. IPv6 will coexist with the older IPv4 for some time.

What is IPv4 -- Internet Protocol Version 4 ?

IPv4 (Internet Protocol Version 4) is the fourth revision of the Internet Protocol (IP) used to to identify devices on a network through an addressing system. The Internet Protocol is designed for use in interconnected systems of packet-switched computer communication networks (see RFC:791).

IPv4 is the most widely deployed Internet protocol used to connect devices to the Internet. IPv4 uses a 32-bit address scheme allowing for a total of 2^32 addresses (just over 4 billion addresses). With the growth of the Internet it is expected that the number of users will increase. And eventually the number of users will be more than 4 billion at the same time. Hence. the unused IPv4 addresses will eventually run out because every device -- including computers, smartphones and game consoles -- that connects to the Internet requires an address.

A new Internet addressing system Internet Protocol version 6 (IPv6) is being deployed to fulfill the need for more Internet addresses.

 

What is IPv6 -- Internet Protocol Version 6 ?

IPv6 is more advanced and has better features compared to IPv4. It has the capability to provide an infinite number of addresses. It is replacing IPv4 to accommodate the growing number of networks worldwide and help solve the IP address exhaustion problem. IPv6 was developed by the Internet Engineering Task Force (IETF).

IPv6 (Internet Protocol Version 6) is also called IPng (Internet Protocol next generation) and it is the newest version of the Internet Protocol (IP) reviewed in the IETF standards committees to replace the current version of IPv4 (Internet Protocol Version 4). 

IPv6 uses a 128-bit address scheme, allowing a total of 2^128 addresses (infinite). Increasing the pool of addresses is one of the most often-talked about benefit of IPv6.

The Difference Between IPv6 and IPv4 IP Addresses

An IP address is binary numbers but can be stored as text for human readers.

A 32-bit numeric address (IPv4) is written in decimal as four numbers separated by periods. Each number can be zero to 255.

For example, 1.160.10.240 could be an IP address.

IPv6 addresses are 128-bit IP address written in hexadecimal and separated by colons.

An example IPv6 address could be written like this: 3ffe:1900:4545:3:200:f8ff:fe21:67cf

Read More

Essential Concepts - Network Protocols (IP)

Before reading this article, I suggest you to read the Previous article in order to maintain the sequence of the chapter.

NETWORK PROTOCOL

A network protocol (or just referred to as protocol) is a set of rules and conventions that are necessary for the communication between two network devices. For example, two computers on a network can communicate only if they agree to follow the protocols.

The following are some of the most widely reffered protocols :IP, HTTP, FTP, SMTP, Telnet, SSH.

Internet Protocols (IP Address) :An Internet Protocol address (IP address) is a unique number assigned to each computer or device (such as printer) so that each of them can be uniquely identified on the network.

• Types of IP Address :
• Private IP address : A private IP address is the one that is assigned to a computer on the Local Area Network (LAN). A typical example of private IP address would be something like:
  192.168.0.2
• Public IP address : A public IP address is the one that is assigned to a computer connected to the Internet. An example public IP address would be something like:
  59.93.115.125

• In most cases a computer gets connected to the ISP network using a private IP. Once a computer is on the ISP network it will be assigned a public IP address using which the communication with the Internet is made possible.
• ISP - Internet Service Provider : You all know the full-form but do you know the meaning?!!.....The server which provides the internet service is called ISP. In case, suppose you are using JIO Sim on your mobile for internet connection, JIO becomes your ISP as it provides you Internet Service (now-a-days FREE).

How to Find the IP Address of a Computer?

Finding your public IP is extremely simple. Just type “what is my IP” on Google to see your public IP address displayed in search results.

 Above image shows public IPv6 address of my laptop

In order to find your private IP, just open the command prompt window (type cmd in the “Search” box) and enter the following command:

ipconfig/all

 IPv4 Address & IPv6 Address in the above image shows private addresses

If you are connected to internet, then Temporary IPv6 address will also be listed which will be your Public IPv6 address. 

NOTE : A computer always has a private IP address. But when it gets connected to internet, the ISP provides it with a public IP address.

This is because, there are many ISPs (JIO, BSNL, Airtel, etc.. in India)across the world. Each ISP is given a range of IPs which they are allowed to use. And when we get connected to internet via ISP, it allocates us an IP which is not in use, from the range of IPs allocated to them.

Read More

Essential Concepts - Computer Network and Network Host

Now, let us begin to understand some of the basic concepts that are essential in laying the groundwork for our journey of learning how to hack. Before actually jumping into the hands-on approach, it is highly necessary for one to have a thorough understanding of the basics of computer network and their working model. In this chapter you will find a brief description of various concepts and terminologies related to computer networks, encryption and security.

COMPUTER NETWORK

A computer network is a group of two or more computers linked together so that communication between individual computers is made possible. Some of the common types of computer network include:

• Local Area Network (LAN) : This is a type of computer network where interconnected computers are situated very close to each other say for example, inside the same building.
• Wide Area Network (WAN) : This is a type of computer network where interconnected computers are separated by a large distance (a few km to few hundreds of km) and are connected using telephone lines or radio waves.
• Internet : The Internet is the largest network which interconnects various LANs and WANs. It is a global system of various interconnected computer networks belonging to government or private organizations.

NETWORK HOST :

A network host (or simply referred to as a host) can be any computer or network device connected to the computer network. This computer can be a terminal or a web server offering services to its clients. When a number of computers are connected with the help of any type of the networks mentioned above, the computer which provides different types of services to other computer is called a Network Host.

Here, it could be identified as a server-client relationship. The one which provides services to other is called as a Server and the one which takes the service is called a Client.

Taking some common examples to understand the phenomenon :

1. Take the example of world's best search engine, Google. When you search something in google, what happens? What do you think! In reality, Google is a large server of computers interconnected using any of above mentioned computer networks and it serves as a Host to us. Data we search, is in fact stored in the computers that are interconnected. The Main computer searches for the data in other computers and returns all the data found, to our computer on the browser.
2. Take a second example for Cloud Storage like Google Drive. You think it as the data is stored online. But did you ever thought where would the data be stored ? In the clouds!!...Here, the data is really stored in a computer which acts as a Host to us and provide the data whenever needed. Here, we are connected to that Host via Internet.

Read More