HTTP headers

It is interesting the amount of information that is sent when you just type http://www.google.com.
In this kind of chats between client and server, the client sends to the server a GET query and usually the server would reply with an OK. This is the normal behaviour. There are other cases when you request a website and the server response that this url has been moved. For example:

1.You enter an URL in your browser an

2 . Your browser generates the following HTTP header and it will be sent to the server.

In the above image, there is a lot of information that is sent to the server, like your OS, the web-browser that you are using, language…etc

All this information could be used by servers for statistics.

3. Server will respond with an OK message  to say that the content requested exists

From the above  screenshots you can see what kind of technology is used by the server.

This is the basic query>response but if you get all the HTTP headers in a secure connection there will be more information and more connections required.

In this kind of connection there is a query to an OCSP (Online Certificate Status Protocol) which is an Internet protocol used for obtaining the revocation status of an X.509 digital certificate. This OCSP request contains the user certificate serial number that will be sent to the server. The server then checks that user certificate is still valid and sends back an OCSP  responder confirming that the certificate is OK. It is a good protocol to discuss in future posts.

In general, if you check all http headers between you and any server, you could get a lot of information. I don’t belive  that not all server administrators are aware of this. Some types of information do should not be sent to the client, this would prevent  reconnaissance attacks and possibly software exploiting attacks.

Source: http://www.wikipedia.org