HTTP, DNS, and TLS analysis focuses on understanding how these protocols behave on the network and how pentesters inspect them during sniffing, traffic monitoring, and forensic analysis. These protocols reveal user activity, domain behavior, encryption strength, and potential weaknesses. Proper analysis helps identify misconfigurations, data leaks, and vulnerabilities across modern networks.

HTTP Analysis

HTTP traffic is human-readable and often exposes sensitive information when not encrypted. Pentesters analyze headers, methods, parameters, and payloads to understand user actions and identify weaknesses.

Capturing HTTP Traffic

sudo tcpdump -i eth0 port 80

Key HTTP Elements to Analyze

1. Request Methods
Common methods include:
GET, POST, PUT, DELETE, OPTIONS.
POST requests often contain login credentials or form submissions.

2. Headers
Important headers include:

User-Agent
Cookie
Host
Referer
Authorization

Cookies often reveal session identifiers that can be hijacked if not protected.

3. URL Parameters
Query strings may expose:

IDs
Tokens
API keys
Sensitive user data

4. HTTP Response Codes
Codes indicate server behavior:
200 OK, 301 Redirect, 403 Forbidden, 500 Server Error.

HTTP Analysis in Wireshark

Useful filters:

http

http.request.method == "POST"

http.cookie

HTTP traffic helps identify login patterns, cleartext credentials, session cookies, and internal application behavior.

DNS Analysis

DNS reveals domain lookups and internal hostnames. Because DNS is usually unencrypted, it leaks browsing behavior and network structure. DNS analysis helps map networks and identify tunneling or spoofing attempts.

Capturing DNS Traffic

sudo tcpdump -i eth0 port 53

Key DNS Elements to Inspect

1. DNS Queries
Queries reveal:

Domains visited
Internal hostnames
Service discovery
Application behavior

2. DNS Responses
Responses reveal:

Real IP addresses
CNAME chains
Subdomain relationships

3. Suspicious Patterns
Indicators include:

High query volume
Random subdomains
Long encoded names
Unexpected external DNS servers

These patterns may indicate malware or DNS tunneling.

DNS Analysis in Wireshark

Useful filters:

dns

dns.qry.name contains "internal"

DNS traffic helps reconstruct browsing behavior, detect tunneling, and map internal network hosts.

TLS Analysis

TLS encrypts HTTP traffic, but metadata remains visible. Pentesters analyze TLS handshakes, certificates, and protocol versions to identify security weaknesses or outdated configurations.

Capturing TLS Traffic

sudo tcpdump -i eth0 port 443

Key TLS Elements to Inspect

1. Client Hello and Server Hello
These messages reveal:

TLS version
Cipher suites
Extensions
Compression methods

Weak versions or ciphers indicate outdated security.

2. SNI (Server Name Indication)
SNI reveals the target domain even when content is encrypted.

Wireshark filter:

tls.handshake.extensions_server_name

3. Certificate Information
Certificates reveal:

Domain names
Issuer
Validity
Internal hostnames
Certificate chains

Weak certificates indicate misconfigured HTTPS.

4. TLS Versions
Older versions such as TLS 1.0 and 1.1 are insecure.

Wireshark filter:

tls.record.version

5. TLS Errors
Handshake failures indicate:

Protocol mismatches
Expired certificates
Weak cipher negotiation

TLS Analysis in Wireshark

Useful filters:

tls

ssl.handshake.type == 1

TLS analysis helps evaluate encryption strength and detect downgrade attempts or MITM activity.

Why HTTP, DNS, and TLS Analysis Matters

Pentesters use these analyses to understand how users and systems communicate. HTTP reveals content, DNS reveals destinations, and TLS reveals encryption behavior. Together they provide a full picture of network activity, allowing detection of weaknesses, misconfigurations, and data exposure.

Intel Dump

HTTP analysis reveals headers, cookies, URLs, and POST data
DNS analysis exposes domain queries and internal hostnames
TLS analysis inspects handshake metadata, certificates, and encryption strength
Tools include tcpdump and Wireshark
Useful for identifying misconfigurations, tunnels, and sensitive leaks