So what is the difference between a web server and web application?
Now you may also hear this referred to as a web appliance,
but I'm probably going to be sticking with web application.
That's a great question. I'm glad you asked.
A web server is the platform that's going to actually be hosting our web
applications.
Basically, like when we go inside a Windows server
and we're setting up roles and features,
a server role would be something like DNS, because that's now a DNS server.
And a feature would be something attached to that.
That is an add on to the actual role.
The same thing applies here where a web server is the actual role of the actual
server itself
and the platform that we utilize for that web server identifies it as such.
And the web application is going to be something added on top of the web server
for us to be able to enhance our experience with the actual web server itself.
So in practical instance,
that let's say we have a Windows environment, we would install IIS
to be that web server.
And then later on, we can install something like PHP as a web application.
But it requires that we have IIS installed first in order to be able to utilize
it,
because otherwise request from a client would go to that system.
And if there was no web server installed, just PHP,
then it wouldn't make any sense.
And the server itself would just respond back with,
I don't know why you're requesting on 480 and 4443.
I'm not a web server.
I don't do that.
So we install the actual platform for web server first,
and then all the bells and whistles as a feature in addition for our web
applications to enhance the overall experience and usage.
Now there are usual suspects.
And I know I already mentioned that I'd be using that phrase.
And the usual suspects, primarily that we'll be dealing with throughout this
course
for the remainder are Apache and IIS being that Apache is primarily installed
on POSIX based systems.
Yes, there are solutions to where you can install it on Windows.
We won't really be looking at that.
We're going to be trying to stick with the native environments here.
And then there's also IIS, which is the Windows world.
And then usually those two as our web servers will be adding different features
on top of each one of them to enhance the experience and also allow us to be
able to test our skills out.
Now in the playground that I have set up that we're going to be introducing
later
in this skill, we have IIS as our base web server and the different bugs
that we're going to be working with are going to be our web applications.
So we have SQL, PHP, all these different things that we run behind the scenes
that require a web server to answer the call for all the clients out there.
And the same can be said for the actual web clients.
Now, this is kind of a different category altogether, and there are usual
suspects in this category as well.
I want to start by saying that I know that there are BUCUs, a different web
browsers that in existence out there, but we're primarily going to be working
with the ones that are more common than anything else.
You may be asking yourself how I got a list or how did I pick which common
web browsers that we're going to be playing with throughout the remainder of
this course?
Well, I went to Google and said top web browsers.
And as you can see here, I'm going to scroll down and then zoom in for us here.
It gave us the icons and the names of some of these web browsers that we're
going to be messing with.
Primarily, I use Google Chrome, Firefox, and occasionally don't judge me.
Edge, but there's also one that I use as well, just for funsies.
That's right.
Occasionally I'm still in my Windows 95 virtual environment to play those good
old DOS games, and I still keep a copy of Netscape Navigator.
Now you may be wondering why does it look all wonky?
I'm actually on Google right here and Netscape just doesn't know how to work
with the background of CSS, Java, and all the other programs and languages that
are
in existence out there being a web application or a feature to that web server.
You see here, if I go try to click on something, let's say like search, you can
see that I can't communicate securely because SSL and TLS is not a feature or
readily available a feature inside of this copy of Netscape, which is why we're
not going to be covering every single thing that web browsers have out there,
just a couple of the usual suspects.
But I brought this up to show you that some of those features are specifically
on the web application side because the web server itself is functioning.
Otherwise I wouldn't be able to get to Google.
And before we move on, I do want to point out that I'm going to be putting a
couple
of links to different types of documentation out there, specifically for
IIS, Apache, and a couple of those web browsers.
So that way you can take a look at them.
Part of us being able to have access to that documentation is because you, the
user and the learner may not be too familiar with Google Chrome.
You may use Tor, you may use something else, or you may still use an older
system like I am and trying to make the world work inside of Netscape Navigator
.
So having that documentation available to us allows us to be able to go through
and understand things like where do files save?
Where is the temporary folder?
Where does this actually install to?
And knowing things like that allow us to be able to be more familiar with the
protocols and procedures that we use to actually pin test against not only the
web servers, but also the web clients if we need to.
As part of pin testing, if we just say, okay, this vulnerability popped up on
this
particular system, and we don't know much about the actual program itself, what
good does that really do us if we don't know how to go and exploit it?
Later on, when we start getting into directory traversal and breaking into
actual
systems themselves, we can actually go in and use this documentation that's
available to us, usually open source and go through and find those different
file
locations and potentially, let's say, like inside of Windows, the registry keys
that we need to be able to alter to help us gain further access to the system
or
even across the entirety of the network.