So, if you would like to become a good developer, cybersecurity professional or something related to the computing science field
Then you need to learn a bunch of skills, so in this quick article I will explain how Websites work, and also why is it so important for security / development that you understand this.
Let’s start from the basics
- So, websites are usually made from 3 components:
- Host
- Website itself
- Database
- Dependant on the size of the project, additional program may be used in aid of project
Host
Host is nothing more than just a computer with a publicly accessible website. Yes, you can literally host any website or any server on your local computer, however before you get ideas in your mind.
I strictly ADVISE TO NOT HOST ANYTHING FROM YOUR LOCAL COMPUTER TO THE PUBLIC INTERNET. If your server gets compromised, then your whole network and devices within it can get infected. Also you can lose all your money. I will repeat, DO NOT DO IT!
Website
Website is literally the website itself, you’re reading this post on a website, you can build your own one or have CMSes do all the work for You: WordPress, Drupal, Adobe Magento and others.
CMS has it’s own benefits and disadvantages, and so does your own built website. The choice and poison is yours!
Database
Database is crucial, this is where all the sensitive and non sensitive stuff gets stored. Without a database we would have to use files (not recommended)
Databases also usually use something called “SQL” which is a database query language which is responsible for getting, updating, removing records to our database so we don’t have to do it manually.
Why am I telling you all of this? Because it’s crucial that you understand how websites are actually made and how simple it can or won’t be!
It looks something like this:
- The User connects to the website
- Server fetches content and displays the content to the user
- If the user logs in or does something that the database access is required, then the server processes this information and database handles the data.
- Note: Internal services are usually inaccessible by the user(databases for example). However it can still be exploited and accessed if the code/website is vulnerable: (SSRF, SQL-injection, RCE, Misconfigurations)
This is why I’m explaining all of this, if you have an understanding how stuff works, it will also allow you to secure it or exploit it.
Also this educates you as a developer: Because something is not exposed, doesn’t mean it can’t get hacked or exploited.