Taha İslam YILMAZComputer EngineeringTOBB ETUADEO IWS - Computer Forensics

What happens when you type google.com into your browser and press enter?

The «g» key is pressed

• Auto-complete machinery• Depending on browser and private/incognito mode algorithms and suggestions can be different.

The «enter» key is pressed

• Key down event message is transported to KBDHID.sys driver which converts HID usage into a scancode. Scancode is VK_RETURN (OxOD)

• KBDCLASS.sys calls Win32K.sys which figures out which window is active.

• OS calls SendMessage(hWnd , WM_KEYDOWN,VK_RETURN,lParam)

Parse URL

• Url or search term ?• Protocol – « http »

use hyper text transfer protocol• Resource – « / »

retrieve main page (index)

Check HSTS List

• HSTS – HTTP Strict Transport Security • A list of websites that requested to be contacted

via HTTPS only

Convert The Characters

• The browser checks the hostname that are non-ASCII Unicode characters

DNS Lookup

• Browser checks if the domain is in its cache.• If not found, browser calls ‘gethostbyname’

library function (varies by OS) to do lookup.• gethostbyname checks if the hostname is in the

local ‘hosts’ file,if it is not , it makes a request to the DNS server.

• Local router or ISP’s caching DNS server.

Opening a Socket

• HTTP port : 80 - HTTPS : 443• Destination and source port is added in

transport layer.• Destination IP address is added in network layer.• Machine and gateway MAC address is added in

link layer.

TCP Connection Flow• Client chooses an initial sequence number (ISN) and send

the packet to the server with the SYN bit set to indicate it is setting the ISN.

• Server receives SYN and if it is an agreeable mood.• Server sends its own ISN and ACK (client ISN +1)• Client acknowledges the connection by sending a packet

which includes new ISN ( old ISN+1) and ACK (server ACK+1)• Data is tranferred.• To close the connection closer sends a FIN packet.• The other side ACKs the FIN packet and sends its own FIN• The closer acknowledges the other side’s FIN with an ACK

Browser

• Browser parses the HTML • Then browser renders the page.

Thank you for listening to me !