All language subtitles for 2. HTTP Lab

Now, let's see what this actually looks like within our browser, we can access the Chrome dev tools

by clicking on the page, going to inspect this will show us what the browser is exchanging with the

Web server.

So as we refresh in the network tab, it will show us all the requests made within this page in order

for it to render.

As I mentioned earlier, each of these requests come with a status code.

And as you can see, all of them come back as 200 because all of them actually exist.

But now let's say if we go to an invalid page.

As you can see, the website comes back and says, Page, I found it in chrome dev tools, we can actually

see that the status code is coming back as photo for which the browser expects to say not found.

If you go back to our current browser and we load back the website again, we can also see the headers

and information that was exchanged between our browser and the Web server.

By clicking on each of these requests so you can see here, we made a request to take our training.

We use the get method.

We got a 200 back.

This is the IP address for the Web server.

And you can also see all the other information, like our browser information, our hostname and so

on, can also click at the preview and you can see what this website looks like, which kind of matches

exactly with what we render early on.

We could also see the response.

In some cases you may see additional headers where the server replies with some headers and says, hey,

this is what I want to use.

And you can kind of see that this matches the exact thing as you can click on Right Click View page

source.

And they both actually match.

So this is what the server is returning when we make our request and in return it gets rendered and

shown to us as a user.

Well, I encourage people to get familiar with the Google Chrome dev tools.

We can also use burb speed to make these things look nicer and have some automation, additional tooling

while we hack.

You can download Bourbaki by going to the ports for our website, scrolling down and looking at the

different burb additions and clicking on the one that fits your needs.

For the sake of this scores, I highly recommend using the community version, which is free.

It may be limited, but it gets the job done for us.

If you have a little bit of extra cash and you want to upgrade, your brevetti license can spend four

hundred dollars per year per user and download the professional version that comes with different scanners

and additional tooling can download the community version by clicking on get community and pushing.

Download that his version and selecting your operating system and clicking download.

Once you open a bird seat after you have installed it, it would ask you to either create a new project

or just simply use temporary projects with the default settings as you start it off.

Now we have opened up.

We want to make sure that our browser knows how to communicate with burb suite.

When you make a request to a website that's using https, your information is getting encrypted before

it's sent to the web server.

So nobody else on your network could actually intercept that data and decode it and use it.

So what we're going to do next is we're going to tell the browser, hey, burb suite is a trusted resource.

I want you to allow him to see the information that I'm sending to each Web server and allow him to

change or modify it.

In order to do this, we want to download the speed certificate within our browser and also install

it in Google Chrome.

The steps to install the certificate may change depending on your browser and the operating system you're

using, but they all may be a little similar.

In order for speed to be able to intercept each request sent to any Web server, we want to make sure

our browser knows a Bourbon Street is a trusted resource.

This ensures that every bit of data we're sending to the Web server is encrypted and nobody on your

local network can actually access or view the information that they're sending through.

That could be passwords, usernames, bank account information and so on.

So by installing burb speed certificate, we're telling our browser, hey, I trust burb suite, let

him access my data without it being encrypted, actually decrypted and send it through before it hits

the Web server.

In order to install the certificate, I want to make sure our browser is actually speaking to burb suite.

You can do this by doing different things.

The first option is to use the Google Chrome default settings by going through proxy and pointing it

to BRB suite.

Or you can download tools like Proxy Proxy, which I highly recommend Foxe proxies available on both

Google Chrome and Firefox.

It's highly recommended to use.

It makes it easier to enable and disable your proxy while you're hiking.

So once you have Insull Foxe proxy, we're going to go to options and we're going to add a new proxy.

You can get this information by going to your burb suite, clicking on proxy and then going to options.

Want to make sure that the browser is sending all this information to this current IP address, which

is our local host on Port AT&T.

Once you have done this, we can go to Fox proxy and enable our proxy to use that IP in port for every

request that we make.

Since we haven't installed the birth certificate yet, when we go to any website that uses SSL, the

browser is not going to trust it because it doesn't know what to do with that request.

So, for example, if I go to Twitter dot com, the browser is going to come back and say, wait a minute,

this connection is not private.

Something is up.

Are you sure you want to proceed?

But we can actually install the birth certificate by going to HTP column site.

Stosh Berp.

This will bring up the communications block on page one, the right hand corner.

We can click on a certificate which will download the certificate belonging to upsweep.

Not that we have downloaded the birth certificate.

We're going to go through our chrome settings, type in the word certificate into the search, click

on security, scroll all the way down Manege certificate, go to our trusted route certificates, import

and import a certificate that we just download it once to import and push finish.

It's going to make sure that we want to install the certificate as a security measure.

We're going to click yes and allow to import.

Once we've installed our certificate, we're going to simply exit out of Google Chrome and relaunch

it to make sure all the security settings have been applied.

Now that we've opened up our browser again, we're going to type in Twitter just to make sure it works.

As you can see now, we can actually launch our proxy again.

Now we can turn on the intercept and within verb suite and allow our browsers request to be intercepted.

As you can see, every time we make a different request, it is actually able to intercept and show

us what each request looks like.

Now, let's go back to our training website.

And as you can see, your browser is going to intercept every request you make and it's not going to

work unless you forward it.

So until you press forward, find the browser is going to be hanging and waiting for your actions.

So if we look forward, meaning the website loads and we can see the material from the training course.