01. How the Web Works

You can't break what you don't understand. Every web bug comes down to a request the developer didn't expect.

Client & Server

A web application is a conversation between two sides:

Client

Your browser. Runs HTML, CSS and JavaScript. You fully control it.

Server

Their machine. Runs the app logic and talks to the database. You only control what you send it.

The golden rule Anything that comes from the client can be changed by the client. Form fields, hidden inputs, cookies, headers, JavaScript checks: all of it. If the server trusts it, that's a bug.

HTTP Requests

Every click, form submit, and page load sends an HTTP request. It's just text:

POST /login HTTP/1.1
Host: shop.example.com
Cookie: session=a8f3c91e
Content-Type: application/x-www-form-urlencoded

username=alice&password=hunter2

Part	What it is	Why hackers care
`POST`	Method (GET, POST, PUT, DELETE...)	Sometimes a different method skips a check
`/login`	Path, plus an optional `?query=string`	Parameters in the URL are trivial to change
Headers	Metadata: Host, Cookie, User-Agent...	Cookies hold your identity
Body	Data being sent	Main place to inject input

HTTP Responses

HTTP/1.1 200 OK
Content-Type: text/html
Set-Cookie: session=7d21bb04; HttpOnly

<html>Welcome back, alice!</html>

Status	Meaning
`200`	OK
`301 / 302`	Redirect
`401 / 403`	Not logged in / not allowed. Interesting!
`404`	Not found
`500`	Server error. You probably broke something. Very interesting!

Cookies & Sessions

HTTP is stateless: each request stands alone. So how does a site remember you're logged in?

You log in successfully.
Server responds with Set-Cookie: session=7d21bb04.
Your browser automatically sends Cookie: session=7d21bb04 with every later request.
Server looks up who owns that session.

Think like an attacker What if the cookie isn't a random ID, but something readable like role=user? What if you could steal someone else's cookie? You'll try both later.

Where Input Goes

Most vulnerabilities happen when your input lands somewhere it gets interpreted instead of treated as plain data:

Your input ends up in...	Bug class
A SQL query	SQL Injection
A shell command	Command Injection
An HTML page	Cross-Site Scripting (XSS)
An ID used to look up data	IDOR / Broken Access Control

02-tooling →