Web Security Basics

Before diving into web security, you need to understand how websites actually work. When you type a URL in your browser, here's what happens:

1. DNS Resolution: Your browser asks DNS servers to translate the domain name (like google.com) into an IP address
2. TCP Connection: A connection is established with the web server using the TCP/IP protocol
3. HTTP Request: Your browser sends an HTTP request asking for the webpage
4. Server Processing: The server processes your request, possibly querying databases
5. HTTP Response: The server sends back HTML, CSS, JavaScript, and other resources
6. Rendering: Your browser renders all these resources into the page you see

Understanding this flow is crucial because attackers can target each step of this process.

HTTP requests use different methods to indicate what action you want to perform:

• GET: Retrieve data (loading a page)
• POST: Submit data (login forms, file uploads)
• PUT: Update existing data
• DELETE: Remove data
• OPTIONS: Check what methods are allowed

Headers carry important metadata with each request and response:

The OWASP Top 10 lists the most critical web security risks. Here are the ones you'll encounter most often in CTFs:

1. Injection - When untrusted data is sent to an interpreter (SQL, command, etc.) 2. Broken Authentication - Weak session management, credential stuffing 3. Sensitive Data Exposure - Unencrypted data, information disclosure 4. XML External Entities (XXE) - Exploiting XML parsers 5. Broken Access Control - Accessing resources you shouldn't 6. Security Misconfiguration - Default credentials, verbose errors 7. Cross-Site Scripting (XSS) - Injecting malicious scripts 8. Insecure Deserialization - Manipulating serialized objects 9. Using Components with Known Vulnerabilities - Outdated libraries 10. Insufficient Logging - Not detecting attacks

In beginner CTFs, you'll mostly see injection, XSS, and broken access control.

Every web security researcher needs these tools:

Browser Developer Tools (Built-in, Free)

• Network tab for HTTP traffic
• Console for JavaScript debugging
• Elements for DOM inspection
• Application tab for cookies and storage

Burp Suite Community Edition (Free)

• Intercept and modify HTTP requests
• Spider websites automatically
• Scan for common vulnerabilities

cURL (Command line, Free)

• Make HTTP requests from terminal
• Great for scripting and automation

One of the first things to check on any website is robots.txt - a file that tells search engines which pages not to index. Ironically, this often reveals sensitive paths!