Introduction to Websites & Dynamic Content

Size: px

Start display at page:

Download "Introduction to Websites & Dynamic Content"

Ariel Fields
8 years ago
Views:

1 Copyright: The development of this document is funded by Higher Education of Academy. Permission is granted to copy, distribute and /or modify this document under a license compliant with the Creative Commons Attribution-NonCommercial-ShareAlike 3.0 Unported License. To view a copy of this license, visit Introduction to Websites & Dynamic Content BLOSSOM Manchester Metropolitan University (Funded by Higher Education Academy) l.han@mmu.ac.uk

Attribution-NonCommercial-ShareAlike 3.0 Unported License. To view a copy of this license, visit http://creativecommons.

2 1. Learning Objectives This lab mainly focused on basic understanding about static and dynamic web pages, cookies, which could be a prerequisite lab for other webrelated security lab. 2. Preparation 1) Under Linux environment 2) Some documents that you may need to refer to: 3. Tasks 'Virtual-MachineGuide.pdf' Linux-Guide.pdf BLOSSOM-UserGuide.pdf Setup & Installation: Start a single virtual machine as you have done with previous exercises (see Virtual Machine Guide) # kvm -cdrom /var/tmp/blossomfiles/blossom-0.98.iso -m 512 -net nic,macaddr=52:54:00:12:34:57 -net vde -name node-one

Tasks 'Virtual-MachineGuide.pdf' Linux-Guide.pdf BLOSSOM-UserGuide.

3 Task 1 Static & Dynamic Pages - POST / GET 1.1 As most of the readers of this document will be aware, websites can be categorised into two different types; Static and Dynamic (Web 2.0). Static web pages rely on a handful of pre-written pages and relay the same content to all users who visit. An example of a html page is below: <html> <body> <p> Hello World! </p> </body> </html> The only way to change the above message is for the administrator to alter the code. The page will appear the same for everyone who visits the page. 1.2 Dynamic pages are not constant, i.e., their content isn't static. They often rely on user input. This cannot be implemented through standard HTML code, it requires a server side language; PHP, Python or CGI are just some of many examples. Below is an example of a PHP page that relays a user message via the URL: <?php //message.php $message = $_GET['message']; echo "$message <br>"?> When the above page is loaded via the URL "message.php?message='helloworld'", the php code will render the HTML page below: Hello World <br>

</p> </body> </html> The only way to change the above message is for the administrator to alter the code. The page will appear the same for everyone who visits the page. 1.

4 1.3 HTTP POST and GET are request methods for the HTTP protocol. Understanding them and their differences forms an essential part of creating dynamic pages. POST should be used when you are explicitly sending data, such as uploading a file. RFC 2616 states: "POST method is used to request that the origin server accept the entity enclosed in the request as a new subordinate of the resource identified by the Request-URI in the Request-Line." In contrast to POST, GET purely passes the URL and headers to the webpage. GET was used in our earlier dynamic page to pass information to the PHP code. 1.4 Now that we understand the basics of PHP, we can make a few very basic PHP pages ourselves. Create a directory in /var/www called 'webintro' and navigate to it using the following commands: # mkdir /var/www/webintro # cd /var/www/webintro Whilst in this directory, open your preferred text editor and name the file 'basic.php': # gedit basic.php We can now begin creating a PHP page. Refer back to the code example given in task 1.2 in order to develop a basic understanding of how the code is written and formatted, and then create a PHP page that will take in a number as an input via the URL, square it, and then add one to the result. The result will then also need to be printed out to the page's display. HINT: The method for powers is pow(number,exponent) HINT#2: URL will start with '

RFC 2616 states: "POST method is used to request that the origin server accept the entity enclosed in the request as a new subordinate of the resource identified by the Request-URI in the

5 Task 2 Cookies 2.1 Cookies are integral to modern websites, particularly dynamic ones. Cookies have a lot of bad press, but their intended used is not sinister at all. A cookie is just a small piece of arbitrary data stored on the client's computer by the web server. It can be used for anything, but is most commonly used to identify particular users on a website. As people's IP addresses change frequently, it's an almost guaranteed way of identifying a particular user. If you know the user, you can personalise your dynamic content accordingly. Setting cookies in PHP is very easy: <?php setcookie("foo", "BAR", time()+3600);?> The above code creates the cookie Foo, gives it the value BAR, and gives it an expiration time of one hour. 2.2 We will now make a PHP page in the same directory as the one we made before, except this PHP page will set a cookie and then display the value that has been set. Create a file called 'cookie.php' and open it in your preferred text editor as with before. Create a cookie referring to your name, give it a numerical value, and then provide it with an expiration time. Refer to the code example in task 2.1 for a similar example. HINT: Cookies are stored in $_COOKIE["name"], where name is the name attached to the cookie value. Task 3 Summary Questions 3.1 What is the difference between a dynamic and static web page? 3.2 You want to create a website that displays a list of battles in English history, would you use a dynamic or a static page? 3.3 You want to create a webpage that gives the current weather at any given location. Would you use a static page, and if so, why? 3.4 When do you use POST? 3.5 What is a cookie? 3.6 Why is tracking IP addresses to identify users a bad idea?

As people's IP addresses change frequently, it's an almost guaranteed way of identifying a particular user. If you know the user, you can personalise your dynamic content accordingly.

6 3.7 Why do you think cookies are set with an expiration time?

SQL Injection. Blossom Hands-on exercises for computer forensics and security

SQL Injection. Blossom Hands-on exercises for computer forensics and security Copyright: The development of this document is funded by Higher Education of Academy. Permission is granted to copy, distribute and /or modify this document under a license compliant with the Creative