Wednesday, January 22, 2020

What happens when you type google.com?



This is one of the most common and basic questions and actually it is a nice way of explaining what is going on behind the scenes when we browse internet. It is not wrong to say that, "a lot" is going on when you click google.com or any website. Both on network layer and on application layer.
Mainly the steps are DNS lookup phase, than TLS handshake and than fetching the page




  1. So in the first step, when you type and click, you ask your computer to resolve a hostname, the first place that will be checked is the local DNS cache of my client, which stores DNS information that computer has recently retrieved.
  2. If required record cant be found on local cache than a query is done to your ISP’s recursive DNS servers. Recursive DNS servers check their own local caches before forwarding the query to root DNS servers.
  3. If recursive DNS servers don't have the record in cache than they send query to root DNS servers.  13 root name servers contain pointers for all Top Level Domains (TLDs) such as .com, .net etc. So if we are trying to reach google.com, the .com the query will be redirected to TLD name servers responsible for .com root pointers.
  4. TLD DNS servers do not store DNS records for individual domains, instead they keep track of the authoritative name servers for all the domains in their TLD. TLD name servers look at the next part of the query from right to left, than direct the query to authoritative name servers for google.com.
  5. Authoritative name servers contain all of the DNS records for given domains. Such as host records (which store IP addresses) A record , MX records (which identify nameservers for a domain and so on. In this case we are looking for the IP address of google.com. The recursive server queries the authoritative nameservers and asks for the host record for google.com.
  6. Recursive name servers gets the host record for google.com from authoritative name servers and stores this record in local cache. After this point when someone asks for the same record, than recursive server can answer itself.
  7. Finally recursive server sends the host record to client computer back. Client computer also stores the record in its cache and passes the IP address to browser. Now web server passes the web page to browser.
After this TLS handshake is done which is explained in another post.

Than, first html file is fetched and html parsing is done. Than the linked resources are fetched like media content.




TLS/SSL Vulnerabilities

POODLE:  The SSL 3.0 vulnerability is in the Cipher Block Chaining (CBC) mode. Block ciphers require blocks of fixed length. If data in th...