## Analyzing HTTP Traffic

HTTP is the language of the web (and most malware).

### The Request
*   **Method**:
    *   GET: Retrieve data.
    *   POST: Send data (Logins, Uploads). **Focus on POSTs**.
*   **User-Agent**: Who is asking?
    *   `Mozilla/5.0... Chrome/90...`: Normal Browser.
    *   `Python-urllib/3.0`: Python Script. (Suspicious on a user laptop).
    *   `Struts-Shock`: Exploit tool.
*   **Host**: The domain.
*   **Referer**: Where did you come from? (Did you click a link on Google, or a link on a Phishing site?)

### The Response
*   **Status Codes**:
    *   `200 OK`: Success.
    *   `301/302`: Redirect.
    *   `401/403`: Unauthorized. (Brute Force?)
    *   `404`: Not Found. (Scanning?)
    *   `500`: Server Error. (Exploit crashed the server?)

### Analysis Scenario
1.  **Alert**: "Suspicious User-Agent".
2.  **Packet**: `POST /upload.php` from IP 10.10.10.5. User-Agent: `DarkSides/1.0`.
3.  **Stream**: The content of the POST is a large blob of encrypted data.
4.  **Verdict**: C2 Exfiltration.