Internet Forensics

Chapter 7. Web Browsers

Chapters 5 and 6 covered what can be learned about a web site and the server that hosts it. This chapter takes a look at things from the other side: what the server can learn about us.

What Your Browser Reveals

A web server needs to know certain things about a browser to return the requested page successfully. First and foremost is the IP address of the machine that is sending the request. Without that, the server doesn’t know where to send the data. Next are the capabilities of the browser. Not all browsers can handle all types of content, and all common browsers will tell the server what they can and can’t accept.

A basic HTTP transaction, fetching a simple web page, starts out with the browser sending a request to the server. That contains the name of the document to be returned, along with the version of the http protocol and the method that should be used to service the request. Also included are a number of headers that convey ancillary information that can help the server tailor its response to the request. Table 7-1 shows a set of these headers that accompanied an example request.

Table 7-1. An example of the header lines in a simple HTTP transaction

Header	Value
Remote Host	208.12.16.2
Referer	http://www.craic.com/index.html
Request Method	GET
Accept	text/xml application/xml application/xhtml+xml text/html;q=0.9 text/plain;q=0.8 image/png */*;q=0.5
Accept-Charset	ISO-8859-1 utf-8;q=0.7 *;q=0.7
Accept-Encoding	gzip deflate
Accept-Language	en-us ...