Aaj Kya Seekhenge?

  • βœ… Internet actually kaise kaam karta hai β€” bilkul basics se
  • βœ… HTTP kya hota hai β€” simple example ke saath
  • βœ… Request kya hoti hai, Response kya hota hai
  • βœ… HTTPS kya hai aur HTTP se kaise alag hai
  • βœ… Status Codes β€” 200, 404, 403, 500 ka matlab
  • βœ… Bug bounty mein yeh sab kaise kaam aata hai

πŸ’‘ Kyun zaroori hai yeh article? Dost, agar tumhe HTTP/HTTPS nahi patatoh tum bugs dhundh nahi sakteΰ₯€ Yeh bug bounty ka backbone haiΰ₯€ Har vulnerability XSS, SQLi, SSRF, IDOR sab HTTP pe hi kaam karta hai!

Pehle Ek Simple Example Se Samjho

Socho tum ek restaurant mein gaye ho

πŸ‘€ Tum (Customer)    =   Browser / Client
🧾 Waiter            =   HTTP Protocol
πŸ‘¨β€πŸ³ Kitchen           =   Web Server
πŸ• Pizza             =   Web Page / Data

Tumne waiter ko bola β†’ "Ek pizza do" = REQUEST

Kitchen ne pizza banaya β†’ waiter ne laya = RESPONSE

Bas yahi hai Internet ka kaam karna! πŸŽ‰

Tum browser mein google.com type karte ho β†’ Browser ek REQUEST bhejta hai Google ke server ko β†’ Google ka server RESPONSE bhejta hai wapas β†’ Tumhare screen pe Google ka homepage dikhta hai!

Internet Ka Poora Journey Step By Step

Jab tum https://google.com type karte ho β€” actually 7 steps hote hain:

Step 1️⃣ β€” URL Type Karo
Tum type karte ho: https://google.com
          ↓
Step 2️⃣ β€” DNS Lookup (Phone Book)
Browser poochta hai: "google.com ka address kya hai?"
DNS Server jawab deta hai: "142.250.195.46"
          ↓
Step 3️⃣ β€” Connection Establish
Browser Google ke server se connect hota hai
Port 443 (HTTPS) pe
          ↓
Step 4️⃣ β€” HTTP Request Bhejta Hai
Browser likhta hai:
GET / HTTP/1.1
Host: google.com
          ↓
Step 5️⃣ β€” Server Request Process Karta Hai
Google ka server request padta hai
Sochta hai β€” "yeh Google ka homepage maang raha hai"
          ↓
Step 6️⃣ β€” HTTP Response Aata Hai
Server bhejta hai:
HTTP/1.1 200 OK
Content: [Google ka HTML page]
          ↓
Step 7️⃣ β€” Browser Page Render Karta Hai
Tumhe Google dikhta hai! βœ…

HTTP Kya Hai? Bilkul Simple

HTTP = HyperText Transfer Protocol

Isko English mein todke samjho:

  • HyperText = Web pages, links, images
  • Transfer = Bhejne ka kaam
  • Protocol = Rules ka set jaise traffic rules

Simple bhasha mein:

HTTP woh language hai jisme Browser aur Server ek doosre se baat karte hain

Jaise tum Hindi mein baat karte ho to dono samjhte hain β€” waise hi Browser aur Server HTTP mein baat karte hainΰ₯€

HTTP Request Andar Se Kya Dikhta Hai?

Jab bhi tum koi website open karte ho ek Request jaati haiΰ₯€ Yeh request kuch aise dikhti hai:

GET /login HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0 (Windows NT 10.0)
Accept: text/html
Cookie: session=abc123xyz
Connection: keep-alive

Isko line by line samjhte hain bilkul easily:

None

HTTP Response Server Kya Bhejta Hai Wapas?

Server ne request padhi ab jawab bhejta hai:

HTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 1256
Set-Cookie: session=newtoken456

<html>
  <body>
    <h1>Welcome to Login Page!</h1>
  </body>
</html>

Isko bhi samjhte hain:

None

HTTP Methods Waiter Ko Order Dene Ke Tarike

HTTP mein alag-alag methods hoti hain har ek ka alag kaam:

πŸ“– GET     β†’ Sirf data maangna (page dekhna)
           Example: google.com open karna

πŸ“ POST    β†’ Data bhejnΨ§ (form submit karna)
           Example: Login form submit karna
✏️ PUT     β†’ Poora data update karna
           Example: Profile completely update karna
πŸ”§ PATCH   β†’ Thoda data update karna
           Example: Sirf naam change karna
πŸ—‘οΈ DELETE  β†’ Data delete karna
           Example: Account delete karna
πŸ‘€ HEAD    β†’ Sirf headers maangna, body nahi
           Example: File exist karti hai ya nahi check karna
βš™οΈ OPTIONS β†’ Server se poochna - tu kya kya support karta hai?

Bug Bounty Mein Kaise Kaam Aata Hai?

πŸ’‘ Real Example: Mujhe ek target mein mila ki /delete-account endpoint sirf POST accept karta tha β€” lekin maine GET request bheja toh bhi kaam kar gaya! Yeh tha ek HTTP Method Bypass vulnerability! Bounty mili! πŸŽ‰

Status Codes Server Kya Bol Raha Hai?

Status codes woh 3-digit numbers hain jo server bhejta hai β€” inhe samjhna bahut zaroori hai:

2xx Success! Sab Theek!

200 OK          β†’ Request successful, page mil gaya βœ…
201 Created     β†’ Naya data create ho gaya βœ…
204 No Content  β†’ Request hui, kuch wapas nahi aaya βœ…

3xx Redirect! Aur Aage Jao!

301 Moved Permanently β†’ Page permanently aur jagah chala gaya
302 Found (Redirect)  β†’ Temporarily doosri jagah bhej raha hoon
304 Not Modified      β†’ Page change nahi hua, cache use karo

4xx Tumhari Galti! Client Error!

400 Bad Request    β†’ Tumne galat request bheji
401 Unauthorized   β†’ Pehle login karo
403 Forbidden      β†’ Permission nahi hai tumhe ❌
404 Not Found      β†’ Yeh page exist nahi karta
405 Method Not Allowed β†’ Yeh method allowed nahi hai
429 Too Many Requests  β†’ Bahut zyada requests bheji, slow down!

5xx Server Ki Galti! Server Error!

500 Internal Server Error β†’ Server crash ho gaya πŸ’₯
502 Bad Gateway           β†’ Server ka doosra server kaam nahi kar raha
503 Service Unavailable   β†’ Server busy hai ya down hai

Bug Bounty Mein Status Codes Kaise Kaam Aate Hain?

🎯 403 mile?  β†’ WAF bypass try karo β€” shayad file exist karti hai!
🎯 500 mile?  β†’ Server crash hua β€” SQL injection possible!
🎯 200 mile unexpected jagah? β†’ Sensitive file exposed ho sakti hai!
🎯 302 mile?  β†’ Open Redirect check karo!

HTTPS Kya Hai? HTTP Ka Secure Bhai

HTTPS = HTTP + Security (SSL/TLS Encryption)

Ek story se samjho:

HTTP Postcard Ki Tarah (Dangerous!)

Socho tum apne dost ko postcard bhejte ho "Mera password: abc123" likhke

Tum βœ‰οΈ β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”> πŸ“¬ Dost
          Postcard open hai!
          Beech mein koi bhi
          padh sakta hai! πŸ‘€βŒ

HTTP mein bhi yahi hota hai sab data plain text mein jaata haiΰ₯€ Koi bhi hacker beech mein "sniff" kar sakta hai!

HTTPS Band Lifafe Ki Tarah (Safe!)

Tum πŸ”’βœ‰οΈ β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”> πŸ“¬ Dost
          Letter band lifafe mein!
          Sirf recipient hi
          khol sakta hai! βœ…

HTTPS mein data encrypt hota hai β€” beech mein koi bhi hacker padh nahi sakta!

HTTPS Kaise Kaam Karta Hai? SSL Handshake

Yeh process 3 seconds mein hoti hai jab bhi tum https:// wali site kholta ho:

Step 1: πŸ‘‹ Browser β†’ Server
        "Hello! Main HTTPS connection chahta hoon"

Step 2: πŸ”‘ Server β†’ Browser
        "Lo mera Public Key (Certificate)"
Step 3: πŸ” Browser β†’ Server
        "Theek hai, main Session Key banata hoon
         aur tere Public Key se encrypt karke bhejta hoon"
Step 4: 🀝 Dono ek hi Session Key use karne lagte hain
        Ab saara communication ENCRYPTED hai! βœ…
Step 5: πŸ”’ Secure Communication Shuru!
        Har ek message encrypted hota hai

HTTP vs HTTPS Side By Side

None

Real HTTP Request Burp Suite Mein Kaisi Dikhti Hai?

Yahi wo cheez hai jo tum Burp Suite mein dekhte ho jab intercept karte ho:

POST /api/login HTTP/1.1
Host: target.com
Content-Type: application/json
Content-Length: 45
Cookie: PHPSESSID=xvz123abc
{
  "username": "admin",
  "password": "password123"
}

Bug hunter ki nazar se yeh request dekho:

🎯 POST /api/login   β†’ Login endpoint hai!
🎯 Content-Type: JSON β†’ API hai β€” test karna chahiye
🎯 username/password  β†’ Brute force? Default credentials?
🎯 PHPSESSID Cookie   β†’ Session hijacking possible?
🎯 HTTP nahi HTTPS?   β†’ Credentials plain text mein ja rahe!

Bas ek request mein 5 potential vulnerabilities! πŸ”₯

HTTP Headers Chhupe Hue Khazane

Headers woh extra information hain jo request/response mein hoti hain bug hunters ke liye goldmine!

Interesting Request Headers:

Host: target.com           β†’ Virtual host attacks!
X-Forwarded-For: 127.0.0.1 β†’ IP spoofing bypass!
Referer: https://evil.com  β†’ CSRF token bypass!
Authorization: Bearer xxx  β†’ JWT token attacks!
Content-Type: text/xml     β†’ XXE injection!

Interesting Response Headers:

Server: Apache/2.4.1       β†’ Version info leak! 🎯
X-Powered-By: PHP/7.2      β†’ Old version = vulnerabilities!
Access-Control-Allow-Origin: * β†’ CORS misconfiguration!
Set-Cookie: session=abc    β†’ HttpOnly flag hai? Secure flag?
X-Frame-Options: missing   β†’ Clickjacking possible!

Practical Burp Suite Mein HTTP Dekho

Chalo ab Kali Linux kholo aur actual HTTP request dekho!

Step 1: Burp Suite Open Karo

# Terminal mein:
burpsuite &

Step 2: Target Setup Free Practice Site

https://httpbin.org
# Yeh website specifically HTTP testing ke liye hai β€” legal hai!

Step 3: GET Request Dekho

1. Burp Suite β†’ Proxy β†’ Intercept ON karo
2. Firefox mein jaao: https://httpbin.org/get
3. Burp Suite mein request capture hogi
4. Dhyan se padho β€” har line samjho!

Step 4: POST Request Test Karo

1. Firefox β†’ https://httpbin.org/post
2. Burp Suite mein request capture karo
3. Right click β†’ "Send to Repeater"
4. Repeater mein request edit karo aur dobara bhejo!

Bug Bounty Mein HTTP Knowledge Kaise Use Hoti Hai?

Har ek vulnerability HTTP pe based hai dekho:

πŸ”΄ XSS          β†’ HTTP Response mein script inject karna
πŸ”΄ SQL Injection β†’ HTTP Request mein SQL code dena
πŸ”΄ SSRF          β†’ Server ko HTTP Request karwana
πŸ”΄ IDOR          β†’ HTTP Request mein ID change karna
πŸ”΄ CSRF          β†’ Victim ke browser se HTTP Request karwana
πŸ”΄ Open Redirect β†’ HTTP Response ke Location header pe attack
πŸ”΄ CORS Issues   β†’ HTTP Headers galat configure hona

Matlab HTTP samjho toh sab kuch samjho! πŸ’‘

YouTube Resources β€” In Se Aur Seekho

Internet kaise kaam karta hai β€” Animation

youtube.com/shorts/rLcgjNUC9fA

HTTP Request & Response Methods Hindi

youtube.com/watch?v=sFt1584SLKY

HTTP Protocol Cyber Kaksha

youtube.com/watch?v=91ZPVXpeLaI

Intro to Web & HTTP Hindi

youtube.com/watch?v=OeqAhIozg8A

Aaj Ka Homework!

1️⃣ Burp Suite open karo
2️⃣ https://httpbin.org/get kholo
3️⃣ Request intercept karo
4️⃣ Har ek header ka naam note karo
5️⃣ Response mein Status Code dekho
6️⃣ Ek POST request bhejo https://httpbin.org/post pe
7️⃣ GET aur POST request compare karo

Ek bonus challenge:

https://httpbin.org/status/404 visit karo β€” kaunsa status code aayega? Aur kya message? Comment mein batao! πŸ‘‡

🧠 Quick Revision Article Ka Summary

🌐 Internet = Browser (Client) + Server communicate karte hain
πŸ“¨ HTTP     = Communication ki language
πŸ“€ Request  = Browser ne server se kuch manga
πŸ“₯ Response = Server ne wapas bheja
πŸ”’ HTTPS    = HTTP + Encryption (SSL/TLS)
πŸ”’ Status Codes:
   2xx = Success βœ…
   3xx = Redirect πŸ”„
   4xx = Client Error ❌
   5xx = Server Error πŸ’₯
🎯 Bug Bounty = HTTP samjho β†’ Bugs dhundho!

πŸ’¬ Meri Baat…

Dost, jab maine pehli baar Burp Suite open ki thi β€” requests dekh ke mera dimaag ghoom gaya thaΰ₯€

"Yeh sab kya hai? GET, POST, 200, 403… kuch samaj nahi aata!"

Lekin jab ek ek cheez samji β€” tab realize hua ki har ek line mein ek bug chhupa ho sakta haiΰ₯€

Agle article mein hum jaayenge directly HackerOne aur Bugcrowd pe β€” account kaise banate hain, pehla program kaise choose karte hain, aur pehla bug kahan dhundhen! πŸ”₯

HackerMD Bug Bounty Hunter | Cybersecurity Researcher GitHub: BotGJ16 | Medium: @HackerMD

Previous: Article #2 Hacker Lab Setup Next: Article #4 HackerOne aur Bugcrowd: Pehla Program Choose Karo

#HTTP #HTTPS #BugBounty #EthicalHacking #Hinglish #CyberSecurity #WebSecurity #BurpSuite #HackerMD