1. Master the Basics, Break the Web: Web & Internet

1. What Is a Web Application?

A web application is software that runs on a server and delivers interactive functionality to users through a browser using HTTP/HTTPS. It processes user input, executes backend logic, interacts with databases, and returns dynamic responses, such as HTML, JSON, or API data. Unlike static websites, web apps continuously change based on user actions, sessions, and stored data.

Why It Matters in Pentesting?

• Every layer (frontend, backend, database) exposes different vulnerabilities.
• Understanding how data flows from browser → server → database helps identify where attacks can be injected.

💡Example: A user clicks “Transfer Money” → browser sends a POST request → backend verifies rules → database updates → response shows “Transfer Successful”.
Pentesters test each step to find bypasses like missing authorization, input tampering, or logic flaws.

2. Client–Server Architecture

Client–server architecture is a communication model where the client (browser/app) sends requests and the server processes them, runs logic, interacts with databases, and returns a response. The client is only responsible for displaying data, while the server controls the actual decision-making and data handling. This separation creates trust boundaries, which are crucial in understanding where attacks can happen.

Client–Server Architecture

Why It Matters in Pentesting?

• Anything validated only on the client side can be bypassed.
• Security must happen on the server — pentesters test whether the server properly re-validates all input.
• Helps identify places where attackers can modify requests, sessions, or parameters.

💡Example: A form hides the “isAdmin” field on the webpage, but the attacker sends:
POST /update-profile isAdmin=true

The server must enforce rules — if it doesn’t, this becomes a privilege escalation.

3.DNS

DNS (Domain Name System) is the service that translates human-readable domain names into IP addresses so browsers know where to connect. When you type a domain, DNS resolves it by checking different servers (root → TLD → authoritative) until it finds the correct record.
Common DNS records include A/AAAA (IP address), CNAME (alias), MX (mail), TXT (verification), and NS (nameservers).

Why It Matters in Pentesting?

• DNS misconfigurations can expose hidden subdomains, internal services, or legacy systems.
• Dangling CNAMEs can lead to subdomain takeover, a high-impact vulnerability.
• Enumerating DNS helps map the true attack surface beyond the main application.

💡 Example: A subdomain like dev.example.com points to an unused cloud resource → attacker claims that resource → gains full control over the subdomain.
Pentesters check DNS records to uncover forgotten assets, misconfigured entries, and takeover opportunities.

4. URL Structure (protocol, host, path, params)

A URL is a structured string that tells the browser exactly how and where to make a request. It includes components like the protocol (HTTP/HTTPS), host (domain), path (resource location), and parameters (user inputs). Each part can influence how the server processes a request, making them important targets for manipulation.

URL Structure

Why It Matters in Pentesting?

• Query parameters often carry user-controlled data that can lead to XSS, SQLi, or IDOR.
• Paths may reveal hidden endpoints or allow traversal if not properly validated.
• Manipulating the host header or protocol can trigger routing issues or open redirect vulnerabilities.

💡 Example: A URL like:https://shop.example.com/product?id=42The id parameters can be modified id=43 to view another product, or fuzzed for injection.
Pentesters test each component to see how the server handles unexpected values.

5. HTTP vs HTTPS

HTTP is a plaintext communication protocol where data travels unencrypted between the browser and the server. HTTPS is the secure version that wraps HTTP inside TLS, providing encryption, integrity, and server authentication. Both use the same request structure, but HTTPS prevents passive snooping and tampering during transmission.

Why It Matters in Pentesting?

• Plain HTTP allows interception and modification of traffic, enabling MITM attacks.
• Weak or misconfigured HTTPS (old TLS versions, missing HSTS, mixed content) exposes users even on “secure” sites.
• Pentesters verify whether sensitive actions, cookies, and API calls are properly protected over HTTPS.

💡 Example: If a login form sends credentials over HTTP, anyone on the same network can capture the username and password. Even with HTTPS, missing HSTS or mixed HTTP resources can still allow downgrade or injection attacks.

6. TLS Handshake

The TLS handshake is the process where the browser and server negotiate how to securely communicate over HTTPS. During the handshake, they agree on encryption methods, verify the server’s certificate, and generate shared session keys. Once the handshake succeeds, all data exchanged is encrypted and protected from tampering.

Why It Matters in Pentesting?

• Weak TLS configurations (old protocols, insecure ciphers) can allow downgrade or MITM attacks.
• Misconfigured or expired certificates weaken server identity validation.
• Understanding the handshake helps pentesters evaluate whether HTTPS is actually secure or only appears secure.

💡 Example: When a user openshttps://example.com, the browser sends a ClientHello → the server responds with ServerHello + certificate → both sides generate keys → secure session begins. Pentesters inspect this process to find insecure TLS versions, weak ciphers, or certificate issues.

7. IP (Internet Protocol)

An IP address is a unique identifier assigned to a device so it can be located and communicated with on a network. It works like a digital address that routes packets from a source machine to a destination machine. IPv4 uses 32-bit numbers (e.g., 192.168.1.5), while IPv6 uses 128-bit addresses for larger networks.

Why It Matters in Pentesting?

• Helps identify which systems are reachable and part of the attack surface.
• IP ranges may reveal additional hosts, environments, or forgotten servers.
• Misconfigured IP restrictions can allow unauthorized access.

💡 Example: A company’s public IP block may expose multiple services besides the main website, such as staging or old admin servers.

8. Ports

A port is a logical endpoint for network communication, allowing multiple services to run on the same IP address. Common ports include 80 (HTTP), 443 (HTTPS), 22 (SSH), and 3306 (MySQL). Ports help the operating system route incoming and outgoing traffic to the correct application.

Why It Matters in Pentesting?

• Open ports reveal available services that may be vulnerable.
• Non-standard ports may expose hidden admin panels or outdated software.
• Port scanning helps map the full attack surface.

💡 Example: A server may run a secure website on port 443 but expose an old Jenkins instance on port 8080, a common entry point for attacks.

9. TCP

TCP (Transmission Control Protocol) is a connection-oriented protocol that ensures reliable communication. It uses a 3-way handshake (SYN, SYN-ACK, ACK) and guarantees ordered, error-checked data delivery. Because of its reliability, TCP is used for web traffic, emails, file transfers, and most application protocols.

Why It Matters in Pentesting?

• TCP services often require authentication and run critical applications.
• The handshake process helps identify open and filtered ports.
• Weak or outdated TCP services can expose sensitive functionalities.

💡 Example: Tools like Nmap send TCP SYN packets to check if a port is open — if the server replies with SYN-ACK, the port is reachable.

10. UDP

UDP (User Datagram Protocol) is a connectionless, fast protocol used when speed matters more than reliability. It sends packets without handshakes, delivery guarantees, or order enforcement. Common UDP services include DNS, DHCP, SNMP, and streaming applications.

Why It Matters in Pentesting?

• UDP services often leak information because they respond without strict validation.
• Many UDP protocols can be abused for reflection/amplification attacks.
• UDP scans can reveal overlooked services that don’t appear in TCP scans.

💡 Example: A DNS server on port 53 (UDP) might return zone information or respond differently to crafted queries, exposing internal details.

Wrapping up here — next up: HTTP Fundamentals

Catch you soon 🙌,
Abinesh