Wireshark 101: Hypertext Transfer Protocol; HakTip 130 Video Lecture | Start Using Wireshark: Do Hacking like a Pro - Back-End Programming

this episode of pack tip is brought to
you by HipChat welcome to active the
show will we break down concepts tools
and techniques for hackers gurus and IT
ninjas I'm Shannon Morse and today we
are checking out Wireshark and HTTP HTTP
stands for hypertext Transfer Protocol
and this is another common upper-layer
protocol that you run into from time to
time in Wireshark specifically HTTP can
be found in layer seven of the OSI model
now HTTP allows your web browser to
connect to a server and allow you to
view a website so when you go to hack
five org or youtube.com or anything in
between you are using HTTP now if we
take a look at this in Wireshark you're
going to view one of the packets it's
gonna vary a lot depending on where on
the Internet's you are heading so you
will see a whole lot of different HTT
p-- Achatz as you scroll down in your
packet capture so let's take a look at a
few of these different packet headers so
you can see a few different similarities
or a few same similarities so first off
the first one you will get anytime you
go to a website will be this get HTTP
slash 1-1 it'll generally look like that
once communication is set up between you
and the website server the packet comes
in over TCP port 80 and you can see that
right down here so we see TCP port and
then whatever port it is destination
port 80 now of course the source port
will change depending on your network
and we're going to try the get the web
directory of the server by using HTTP
version 1-1 and that's why up at the top
under info you'll see get HTTP version
1.1 now a little lower down in the
center column is a thing called user
agent info and this is going to tell the
server what kind of information my
computer can accept so if I scroll down
here and check that out there we go user
agent encoding and accepted language so
language will depend on what you set up
your computer for I'm ENGLISH us
encoding can be gzip or whatever you end
up using
and then up here user agent is going to
tell them tell the server what kind of
information I can accept based on my web
browsing now after this packet the
server will send a TCP acknowledgement
to you an HTTP will there on out be used
for application layer commands once TCP
is done HTTP will give you another
packet that says response code 200 and
this means that you've had a successful
request method so if I'm able to access
hak5 org for example and i know i want
to go to hack 5 org because the host
under my first get request says hak5
dorg then i can move down and look at
this is a good example it might not
match this one but whatever it's for a
demo so i can scroll down here and it
says 200 ok and if i look under HTTP or
hypertext Transfer Protocol that'll also
say 200 ok and let's scroll down just a
bit status code 200 response phrase ok
so that means everything went well and
I'm able to connect to the server now
that's really quick and simple after the
break I'll show you what it looks like
when you aren't downloading something
from a server or a web site but instead
you are uploading something like
comments on Twitter we'll be right back
how is your team communicating are they
using a variety of email I am texting
cloud storage and document sharing apps
if chat puts everything in one place and
is designed specifically for business
so the solution HipChat they are I am
video chat document sharing screen
sharing system updates in code sharing
integrated all into one simple platform
emails to slow meetings gets sidetracked
and regular I am doesn't work well for
groups HipChat keeps your team and sync
and it works from any device no matter
where you are and the best part HipChat
integrates with the top developer tools
like github jiriz and desk and more
there's 57 services total that HipChat
plays nice with now HipChat brings your
entire project and team communications
together and they're easy to set up fun
to use and it makes your team wildly
productive now I use HipChat here for
our offices specifically to share code
snippets over with Darin for all my
Arduino builds over on hack 5 super
simple and makes our progress for the
show pretty quick
get your team on the same page in
seconds I want you to try HipChat free
with no credit card required visit
HipChat calm / hack tip sign-up click on
start chatting and then invite a few
team members and try it for free for 30
days
remember that's HipChat calm / hack tip
and for the first 100 signups HipChat is
going to extend their 30-day free trial
to 90 days HipChat your team your
project in sync instantly we are back
with more HTTP now when we need to
upload data to web server such as when
you are posting a tweet or your typing
to somebody in IRC or you're commenting
on somebody's wall on facebook or
whatever you are creating a post packet
via HTTP in Wireshark these need a
three-way handshakes or a request a
response in an ok or a you know whatever
from the client to the server and then
back again this packet will be labeled
as a post packet and the line based text
data will show you the contents of the
data posted if it's available now I'll
show you some of these packets because I
was sitting in IRC and I was able to get
a whole bunch of them coming up whenever
I was posting stuff so if we look at our
packet capture down here in Wireshark we
have HTTP a whole bunch of packets and
then the biggest standout that you're
going to see for these post packets is
post a nice big letter so it's very easy
to see now if we scroll down to the
center column I'll go ahead and make it
a little bit bigger for you guys and
scroll under HTTP the hypertext transfer
protocol area and we just maximize all
this different tree stuff scroll down a
bit more we can see that there we go our
host is the IRC web chat that I was in
and if I scroll down all the way to the
bottom that is where you would find your
line based text data if it's available
for you now after all that information
is found what will happen once the
connection has been made is you will
start seeing all your different posts
and all your different get requests from
whatever you're working on
be it IRC or your comments on Twitter
now that is about it for HTTP it's
pretty easy to understand how this level
of protocol works and that rounds out
all the different protocols for
upper-layer explanation now I'm going to
get into
real-world explanations in just a little
bit in the next coming week so let me
know what you think and if you want to
see anything in particular send me a
comment below or email us tips at hack 5
org and be sure to check out our sister
show hack 5 for more great stuff just
like this I'll be there reminding you to
trust your Tecna list