HTTP/HTTPS/HTTP2

4.8 Interpret the fields in protocol headers as related to intrusion analysis

📘Cisco Certified CyberOps Associate (200-201 CBROPS)

---

HTTP (Hypertext Transfer Protocol) Header Fields

HTTP is the main protocol used for web communication. When a client (like a browser) requests a web page from a server, HTTP headers carry essential information about that request or response.

Key Fields in HTTP Headers

1. Request Headers (Sent by Client)

These tell the server what the client wants and give information about the client.

• Host:
  Specifies the domain the client wants to reach.
  Example: Host: www.example.com
  Use in intrusion analysis: Attackers may manipulate the Host header to access internal resources (Host header injection).
• User-Agent:
  Describes the client software (browser, script, or tool).
  Example: User-Agent: Mozilla/5.0
  Use: Can detect unusual clients (like scripts or bots) which may indicate reconnaissance activity.
• Accept:
  Tells the server what content types the client can handle.
  Example: Accept: text/html, application/json
• Authorization:
  Used for credentials like API keys or tokens.
  Example: Authorization: Basic YWxhZGRpbjpvcGVuc2VzYW1l
  Use: Suspicious use of credentials may indicate brute force or stolen credentials.
• Cookie:
  Sent for session management.
  Example: Cookie: sessionid=12345
  Use: Attackers sometimes steal or modify cookies (session hijacking).
• Referer (Referrer):
  Shows the previous page visited.
  Example: Referer: https://www.example.com/home
  Use: Useful to see unusual navigation patterns or phishing attempts.

2. Response Headers (Sent by Server)

These tell the client information about the response and server behavior.

• Server:
  Shows server software.
  Example: Server: Apache/2.4.41 (Ubuntu)
  Use: Can reveal outdated servers vulnerable to attacks.
• Set-Cookie:
  Sets session or authentication cookies.
  Example: Set-Cookie: sessionid=abc123; HttpOnly; Secure
  Use: Security misconfigurations here may allow attacks like XSS or session hijacking.
• Content-Type:
  Tells the client what type of content is being sent.
  Example: Content-Type: text/html; charset=UTF-8
• Content-Length:
  Shows the size of the response body in bytes.
  Example: Content-Length: 512
• Location:
  Used in redirects.
  Example: Location: https://www.example.com/login

---

HTTPS (HTTP Secure)

HTTPS is HTTP over TLS/SSL, meaning the HTTP headers are encrypted during transit.

• Why HTTPS matters for intrusion analysis:
  • You cannot see the headers in plaintext unless you have the server’s private key or perform a man-in-the-middle (MITM) with SSL interception.
  • Attackers often try to downgrade connections to HTTP (insecure) to sniff headers.
  • Security tools inspect HTTPS by decrypting traffic at a proxy or endpoint.
• Important Header Fields:
  HTTPS uses the same headers as HTTP. The difference is encryption.
• Exam tip:
  Know that headers like Authorization, Cookie, and User-Agent are encrypted, which protects sensitive information during transmission.

---

HTTP/2

HTTP/2 is an upgrade to HTTP/1.1 with better performance.

• Key differences in headers:
  • Headers are compressed using HPACK to reduce bandwidth.
  • Multiple requests can be sent in parallel over a single connection (multiplexing).
  • Uses binary framing instead of plain text.
• Headers are still logically the same:
  Host, User-Agent, Authorization, Cookie, Referer, etc., exist but are encoded in a binary format.
• Impact on intrusion analysis:
  • Header compression can hide repeated patterns, making it harder for network monitoring tools to detect anomalies.
  • Security analysts need tools that decode HTTP/2 to inspect headers.

---

Common Security Concerns in HTTP/HTTPS/HTTP2

1. Injection attacks:
   • Host, User-Agent, or Referer headers can be manipulated.
2. Session hijacking:
   • Cookie headers are targeted by attackers to steal sessions.
3. Credential theft:
   • Authorization headers may expose credentials if HTTP is used instead of HTTPS.
4. Reconnaissance detection:
   • Unusual User-Agent strings or missing headers may indicate automated scanners.
5. Misconfigurations:
   • Outdated Server versions, insecure cookies (Secure or HttpOnly missing), and unencrypted HTTP traffic are all risks.

---

Summary Table for Exam

Header Field	Type	Purpose	Intrusion Analysis Use
Host	Request	Target domain	Detect Host header attacks
User-Agent	Request	Client info	Detect bots or scripts
Accept	Request	Client content types	Analyze traffic patterns
Authorization	Request	Credentials	Detect credential abuse
Cookie	Request	Session info	Session hijacking detection
Referer	Request	Previous page	Detect phishing or redirects
Server	Response	Server software	Vulnerability analysis
Set-Cookie	Response	Session cookies	Detect insecure cookie settings
Content-Type	Response	Type of content	Ensure proper content handling
Content-Length	Response	Size of response	Detect anomalies (e.g., data exfiltration)
Location	Response	Redirect URLs	Detect malicious redirects

---

Exam Tips

• Know the difference between HTTP, HTTPS, and HTTP/2.
• Understand which headers are critical for security analysis.
• Focus on Client → Server (request) vs. Server → Client (response) headers.
• Be able to explain how encryption, compression, and binary framing affect header inspection.