Resource Cheatsheet
TryHackMe 9: Putting It All Together
TryHackMe module 9 — load balancers, CDNs, databases, WAFs, web server software, virtual hosts, and static vs dynamic content.
- Updated
- Reading time
- 4 min read
- Detail
- TryHackMe
- Detail
- Putting It All Together
On this page
In one line: behind DNS + HTTP + HTML/CSS/JS sit load balancers (spread traffic, failover), CDNs (nearest-server static files), databases (store data), WAFs (filter attacks), and web server software (Apache/Nginx/IIS) serving files from a root directory — with virtual hosts splitting one server into many sites and backend languages generating dynamic content.
Companion to: TryHackMe Pre Security, Module 9. The full version is the Putting It All Together class notes; the module overview is the TryHackMe module sheet.
Numbering note: filed as Module 9 (after 6=DNS, 7=HTTP, 8=How Websites Work) — the transcript itself confirms this by referencing “the previous modules.”
The extra components
| Component | What it does |
|---|---|
| Load balancer | Spreads requests across servers; round-robin or weighted algorithm; health checks remove unresponsive servers |
| CDN | Hosts static files (JS/CSS/images/video) worldwide; serves from the nearest server |
| Database | Stores/retrieves data — from a text file to multi-server clusters (MySQL, MSSQL, MongoDB, Postgres…) |
| WAF | Sits between client and server; filters attack patterns, bot-like requests, and rate limiting |
Web server software
| Software | Platform | Default root |
|---|---|---|
| Apache, Nginx | Linux | /var/www/html |
| IIS | Windows | C:\inetpub\wwwroot |
- Virtual hosts: one server, many domains — matched by the Host header; each maps to its own root directory; no match → default site.
Static vs dynamic
| Static | Dynamic | |
|---|---|---|
| Changes? | Never | Per request |
| Served | Directly from disk | Generated by backend processing |
| Example | Image, CSS, JS | Blog homepage, search results |
- Backend = server-side (PHP, Python, Ruby, NodeJS, Perl…), invisible in page source.
- Frontend = everything the browser renders.
PHP example
<!-- index.php?name=adam -->
<html><body>Hello <?php echo $_GET["name"]; ?></body></html>→ client receives: <html><body>Hello adam</body></html> — the PHP itself is never sent.
🔐 Security notes
- A WAF filters, it doesn’t fix: it’s a mitigation in front of the app, not a substitute for the app validating/sanitising its own input.
- Load balancers/CDNs widen attack surface too: every backend server and edge node needs consistent config and patching — an inconsistent one is the weak point.
- Backend input is still untrusted input:
$_GET["name"]and equivalents feed directly from the client — unsanitised, this is the same root cause as HTML injection, now with database/SQL injection risk added. - Virtual hosts are matched by a client-supplied Host header — misconfiguration can serve the wrong site.
- Databases are often the real target — everything else is often just the path to reach them.
Practice drills
1. Two problems a load balancer solves?
Handling high traffic across multiple servers, and providing failover if a server becomes unresponsive.
2. Round-robin vs weighted?
Round-robin sends each request to the next server in turn; weighted sends to the currently least-busy server.
3. What does a CDN host, and how does it pick a server?
Static files (JS, CSS, images, video); it picks the physically nearest server to the user.
4. Three things a WAF checks for?
Common attack techniques, whether the request looks like a real browser, and excessive request volume (rate limiting).
5. Default root directory on Linux vs Windows?
/var/www/html (Apache/Nginx on Linux); C:\inetpub\wwwroot (IIS on Windows).
6. How does a server pick which virtual host to serve?
By matching the requested hostname (from the Host header) against configured virtual hosts; no match → default site.
7. Static vs dynamic content — give an example of each.
Static never changes (e.g. an image); dynamic is generated per request (e.g. a blog homepage showing the latest posts).
Key takeaways
- Load balancer = capacity + failover; CDN = nearest-server static delivery; database = data storage; WAF = attack filtering + rate limiting.
- Web server software serves from a root directory; virtual hosts split one server into many sites via the Host header.
- Static = served as-is; dynamic = generated by backend code (PHP/Python/Ruby/etc.), invisible in page source.
- PHP example:
$_GETreads query-string input server-side; only the resulting HTML reaches the client. - Security: WAFs mitigate, don’t fix; backend input is still untrusted input; databases are frequently the real target.