【TryHackMe】Web Application Basics：Walkthrough

# 概要

TryHackMe「Web Application Basics」のWalkthroughです。

https://tryhackme.com/r/room/webapplicationbasics

# Task2

## **Q1**.*Which component on a computer is responsible for hosting and delivering content for web applications?*

**A**.**web server**

## **Q2**.*Which tool is used to access and interact with web applications?*

**A**.**web browser**

## **Q3**.*Which component acts as a protective layer, filtering incoming traffic to block malicious attacks, and ensuring the security of the the web application?*

**A**.**Web Application Firewall**

# Task3

## **Q1**.*Which protocol provides encrypted communication to ensure secure data transmission between a web browser and a web server?*

**A**.**https**

## **Q2**.*What term describes the practice of registering domain names that are misspelt variations of popular websites to exploit user errors and potentially engage in fraudulent activities?*

**A**.**typosquatting**

## **Q3**.*What part of a URL is used to pass additional information, such as search terms or form inputs, to the web server?*

**A**.**Query String**

# Task4

## **Q1**.*Which HTTP message is returned by the web server after processing a client's request?*

**A**.**HTTP response**

## **Q2**.*What follows the headers in an HTTP message?*

**A**.**Empty Line**

# Task5

## **Q1**.*Which HTTP protocol version became widely adopted and remains the most commonly used version for web communication, known for introducing features like persistent connections and chunked transfer encoding?*

**A**.**HTTP/1.1**

## **Q2**.*Which HTTP request method describes the communication options for the target resource, allowing clients to determine which HTTP methods are supported by the web server?*

**A**.**OPTIONS**

## **Q3**.*In an HTTP request, which component specifies the specific resource or endpoint on the web server that the client is requesting, typically appearing after the domain name in the URL?*

**A**.**URL Path**

# Task6

## **Q1**.*Which HTTP request header specifies the domain name of the web server to which the request is being sent?*

**A**.**Host**

## **Q2**.*What is the default content type for form submissions in an HTTP request where the data is encoded as key=value pairs in a query string format?*

**A**.**application/x-www-form-urlencoded**

## **Q3**.*Which part of an HTTP request contains additional information like host, user agent, and content type, guiding how the web server should process the request?*

**A**.**Request Headers**

# Task7

## **Q1**.*What part of an HTTP response provides the HTTP version, status code, and a brief explanation of the response's outcome?*

**A**.**Status Line**

## **Q2**.*Which category of HTTP response codes indicates that the web server encountered an internal issue or is unable to fulfil the client's request?*

**A**.**Server Error Responses**

## **Q3**.*Which HTTP status code indicates that the requested resource could not be found on the web server?*

**A**.**404**

# Task8

## **Q1**.*Which HTTP response header can reveal information about the web server's software and version, potentially exposing it to security risks if not removed?*

**A**.**Server**

## **Q2**.*Which flag should be added to cookies in the Set-Cookie HTTP response header to ensure they are only transmitted over HTTPS, protecting them from being exposed during unencrypted transmissions?*

**A**.**Secure**

## **Q3**.*Which flag should be added to cookies in the Set-Cookie HTTP response header to prevent them from being accessed via JavaScript, thereby enhancing security against XSS attacks?*

**A**.**HttpOnly**

# Task9

## **Q1**.*In a Content Security Policy (CSP) configuration, which property can be set to define where scripts can be loaded from?*

**A**.**script-src**

## **Q2**.*When configuring the Strict-Transport-Security (HSTS) header to ensure that all subdomains of a site also use HTTPS, which directive should be included to apply the security policy to both the main domain and its subdomains?*

**A**.**includeSubDomains**

## **Q3**.*Which HTTP header directive is used to prevent browsers from interpreting files as a different MIME type than what is specified by the server, thereby mitigating content type sniffing attacks?*

**A**.**nosniff**

# Task10

## **Q1**.*Make a GET request to /api/users. What is the flag?*

`/api/users`にGET陸エスを送信すると、レスポンスからフラグを入手できます。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/10f3aa40-2daa-123d-fc01-61b2fb7f655e.png)

**A**.**THM{YOU_HAVE_JUST_FOUND_THE_USER_LIST}**

## **Q2**.*Make a POST request to /api/user/2 and update the country of Bob from UK to US. What is the flag?*

**Hint**.*Note: Watch out for case sensitivity.*

リクエストボディに`country=US`を設定し、`/api/user/2`にPOSTリクエストを送信するとフラグが得られます。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/34fcc7ea-7667-1b8e-d519-5e3cce190b5f.png)

**A**.**THM{YOU_HAVE_MODIFIED_THE_USER_DATA}**

## **Q3**.*Make a DELETE request to /api/user/1 to delete the user. What is the flag?*

`/api/user/1`へ`Delete`リクエストを送信するとフラグを入手できます。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/0f752e39-25aa-49bd-2e83-a98ede94fed5.png)

**A**.**THM{YOU_HAVE_JUST_DELETED_A_USER}**