Dark Arts
  • index
  • BUY ME A BOOK
  • 🪄Dark Magic
    • Pentesting
      • Industry Methodologies
    • Scopes of Testing
    • Reconnaissance
      • Passive
        • WHOIS
        • DNS
          • nslookup
          • dig
        • WAF
        • Subdomain
        • Google Dork
        • Misc. Techniques
        • Leaked Passwords
      • Active
        • Browser & Plugins
        • ping & traceroute
        • fping
        • telnet & netcat
        • DNS
          • Zone Transfer
          • DNS Amplification DDoS Attack Breakdown
        • Misc. Techniques
    • Vulnerability Assessment
    • Attack Types
  • 🕷️Aragoogs Nest
    • Web Application Overview & Security
      • Security Testing
      • Common Threats & Risks
    • Web Application Architecture
      • Technologies
    • HTTP/S
      • Message
      • Request
      • Response
        • Status Code
    • Crawling/Spidering
  • 🧪Potions
    • Web Browsers
    • Computer Networking
      • Network Protocol
      • Packets
      • OSI Layer
        • Layer 3: Network
        • Layer 4: Transport
      • DNS
        • Primary-Secondary
        • Local Name Resolution
        • Domain Hierarchy
        • FQDN
        • Lookups
        • DNS Resolution
        • DNS Records
        • Security: Attack-Defense (Default)
  • 🎆Spells
    • 📜Linux Scroll
    • 📜WebShell Scroll
    • git
      • Attacks + Vulnerabilities
  • 🖼️Flaws w/ Magical Frameworks
    • Windows
      • In a Nutshell
      • CVE-2019-0708: BlueKeep
      • CVE-2017-0144: EternalBlue: MS17-010
      • Attacking Services
        • MS IIS - WebDAV
        • SMB
        • HTTP File Server (HFS)
        • Apache Tomcat Web Server
        • RDP
        • WinRM
      • File System Vulnerabilities
      • Credential Dumping
        • Password Search in Windows Configuration Files
        • Mimikatz
        • Pass-the-Hash Attack
    • Linux
      • In a Nutshell
      • CVE-2014-6271: Shellshock
      • Attacking Services
        • FTP
        • SSH
        • SAMBA
        • SMTP
        • RSYNC
      • Dumping Hashes
  • 🌼Marauder's Boost
    • Privilege Escalation
    • Windows PrivEsc
      • Windows Kernel Exploit
      • Bypassing UAC
      • Access Token Impersonation
    • Linux PrivEsc
      • Linux Kernel Exploit
      • Misconfigured Cron Jobs
      • Exploiting SUID Binaries
      • shells
      • File Permissions
  • ☠️Death Eaters
    • Post Exploitation
      • Windows
      • Linux
  • 🪄OLLIVANDERS
    • nmap
      • Host Discovery
      • Port Scan
      • Service & OS
      • NSE
      • Firewall/IDS Evasion
      • Scan Optimization
      • Misc. Methods
    • ffuf
    • Hydra
    • Metasploit Framework
      • Architecture
      • Must to Know
      • msfvenom
      • Auxiliary Modules
      • Service Enumeration
      • Vulnerability Scanning
      • Imports
      • Automating
    • Vulnerability Scanners
    • Wireshark
  • 🚂Platform 9(3/4)
    • Auth-Auth
      • Authentication
        • Password-based Authentication
        • Basic Authentication
        • Multi-factor Authentication
        • Access Token
        • Token-based Authentication
          • JWT
          • OAuth 2.0
    • Secure Headers
      • Content-Security-Policy (CSP)
    • Cryptography
      • Caesar Cipher
  • ⛲Port Pensieve
    • Enumeration
      • SMB & NetBIOS
      • SNMP
    • Wordlists
  • 🔆DUELS
    • Pivoting
    • SMB Relay Attack
  • 🗺️Marauder's Map
    • Web Application Pentesting
    • API Pentesting
      • GraphQL
        • Primer
    • Mobile Application Pentesting
  • 🎧SIDE CHANNEL
    • Side Channel Analysis
    • Timing Side-Channel Attacks
      • Vulnerable Login
  • 🥃Sky
    • Cloud Basics
    • Cloud Management
      • Shared Responsibility Model
    • Using Cloud Resources
      • Monitoring & Alerts
      • Identity & Access Management
      • Scalability & Availability
      • Solution Design
    • Cloud Providers
    • Cloud Security & Regulatory Compliance
      • Resource Protection
      • ICCA: Cloud Security & Regulatory Compliance
    • ICCA Preparation
      • Knowledge Tests
      • Lab
  • 🔷Obsidian
    • Pentest Engagement
      • Scoping
    • Pentest Ethics
      • Rules of Engagement
    • Auditing Fundamentals
      • Process/Lifecycle
      • Pentest & Security Auditing
      • GRC
      • Standards, Frameworks & Guidelines
      • From Audit to Pentest
  • 💢Threat Modeling
    • Why Threat Model?
  • 📡THREAT INTEL
    • Threat Intelligence
    • Tool Dump
  • 📱Anything-Mobile-IoT
    • Firmware
    • Firmware Analysis
      • Example: CVE-2016-1555
    • Firmware Installation/Flashing
  • 🎉Mischeif
    • Social Engineering
    • Phishing
      • GoPhish
    • Pretexting
Powered by GitBook
On this page
  • Client-Side (Front-End)
  • Server-Side (Back-End)
  • Additional Components
  • Web Application Components
  • User Interface (UI)
  • Client-Side Technologies
  • Server-Side Technologies
  • Databases
  • Application Logic
  • Web Servers
  • Application Servers
  • Client-Side Processing
  • Server-Side Processing
  • Communication and Data Flow
  1. Aragoogs Nest

Web Application Architecture

Web applications are typically built on a client-server model, where different components interact to deliver a functional and secure user experience.

Client-Side (Front-End)

The client represents the user interface (UI) and handles user interaction with the web application. It includes:

  • Web Browsers – Render and display web pages to users.

  • HTML, CSS, JavaScript – Define structure, styling, and interactivity.

  • Frameworks & Libraries – React, Angular, Vue.js, etc., for efficient UI development.

Server-Side (Back-End)

The server manages business logic, processes user requests, and interacts with the database. It includes:

  • Web Server – Handles client requests and serves responses (e.g., Apache, Nginx).

  • Application Server – Processes business logic using programming languages like Python, Node.js, Java, PHP.

  • Database – Stores and manages application data (e.g., MySQL, PostgreSQL, MongoDB).

Additional Components

  • APIs (Application Programming Interfaces) – Enable communication between front-end and back-end or third-party services.

  • Authentication & Security – User authentication (OAuth, JWT), encryption (TLS/SSL), and security mechanisms (firewalls, rate limiting).

  • Caching & Load Balancing – Improve performance and availability (Redis, CDN, Load Balancers).

Web applications consist of a client-side (front-end) for user interactions, a server-side (back-end) for processing, and supporting components like databases, APIs, and security measures. The client-server model ensures seamless communication between these components.

Web Application Components

A web application consists of multiple components that work together to provide functionality, performance, and security.

User Interface (UI)

The UI is the visual part of the application that users interact with. It includes layouts, buttons, forms, and other elements designed for usability and accessibility.

Client-Side Technologies

Technologies used in the browser to handle user interactions and display content:

  • HTML – Defines the structure of the web page.

  • CSS – Styles and enhances the visual appeal.

  • JavaScript – Adds interactivity and dynamic features.

  • Frameworks & Libraries – React, Angular, Vue.js, etc., for efficient UI development.

Server-Side Technologies

Technologies used to handle application logic, process requests, and manage data:

  • Programming Languages – Python, Node.js, Java, PHP, Ruby, etc.

  • Frameworks – Django, Express.js, Spring Boot, Laravel, etc.

  • Security Mechanisms – Authentication, authorization, encryption, and input validation.

Databases

Responsible for storing, retrieving, and managing data:

  • Relational Databases (SQL) – MySQL, PostgreSQL, SQL Server.

  • NoSQL Databases – MongoDB, Redis, Firebase.

Application Logic

Defines the rules and workflows that govern how the application processes requests, interacts with data, and generates responses.

Web Servers

Manage incoming HTTP requests and serve web pages to users:

  • Examples: Apache, Nginx, Microsoft IIS.

Application Servers

Handle backend logic, process API requests, and execute application workflows:

  • Examples: Node.js, Tomcat, Flask, Django.

Client-Side Processing

Execution of tasks and computations on the user's device, typically within their web browser.

Key Characteristics:

  • User Interaction – Handles UI updates, animations, and events.

  • Responsive User Experience – Reduces server load by processing data locally.

  • JavaScript – Main language for client-side scripting.

  • Data Validation – Ensures input correctness before sending data to the server.

Server-Side Processing

Execution of tasks and computations on the server to handle business logic, authentication, and data management.

Key Characteristics:

  • Data Processing – Manages complex operations like database queries and API calls.

  • Security – Enforces authentication, encryption, and access control.

  • Server-Side Languages – Python, Java, PHP, Node.js, etc.

  • Data Storage – Saves and retrieves data from databases.

Communication and Data Flow

Web applications communicate over the internet using HTTP/HTTPS, ensuring proper request-response mechanisms.

  • HTTP Request – Sent by the client to request data or perform actions.

  • HTTP Response – Sent by the server with the requested data or status updates.

PreviousCommon Threats & RisksNextTechnologies

Last updated 4 months ago

🕷️