As a user has decreased and the responsibilities as a cloud provider is increase
Don't let's talk about them
B Fernandez intimately type let's talk about what is the first soda made
80 style data about a particular subject
Mint and configuration API allows users to configure and monitor the settings of the cloud instances
But this is a non-reloadable method APA URL using b**** you can query
The information like 19 169.254. 169.254 if you
I want to read more about this method API then you can simply go through the documentation of AWS Google and I'll show that is
I didn't want this life
No especially useful if the environment is using the
Tim fill twice
What is this a pencil profile allow you to club together. Services and capabilities
Tina symbol profile at the I am stupid attached to Tomato the day. Then you can simply
Get the temporary credential and can you can do damage to the application
Know what is this is intrapersonal intelligence personal what is
Nothing but the identity and access management where
Allow us to Define who has access to the work of who has access to what resources okay
These are used to delegate access to the user application and
It will set the granule permission to securely access the resources
So in order to interacting with the metadata API we can simply the result
Exist interpretation then you can simply use this no doubt about 16.25
169.254
Only exist with antidepressants vitamin it will not affect all it it's not there within the Google
Primatology Google As You Are
Implemented a custom header which is kind of a protection
Against it because using this is how we can simply
Alexa use the URL to access the information that is available to dead body
But using this is important if you cannot add a custom header to that particular URL
Gcp and Azure is not vulnerable to a solid color bedding ideas
Assistant
So this is the big one. And if you are able to identify the cooties
So he has to make a request.
Just logged into my account
Bullhead City Sea-Doo
Citadel multiple instances running over here I'm just going to run the machine
No this is a bunch of information like the public ipv4 DNS using this particular machine
Is accessible it signed up for Amazon Phoenix machine
If you want to Connected there is a multiple options and you can also Connect using the SSS flag
I'm home if you are able to identify this painful than you can simply connect to using its public DNS
So let me download.
Guys
Information that he has that information
Like it says only a read-only permission to the owner okay to this poor CC.
Just keep that in mind maybe it might be useful for the next exercise and here
I'm just using this particular command to connect to that lock box because I have the pamphlet
No that's if you have access to that particular instance we can simply use to call lab
Buddy the metadata API using the table IP address and then
OneMain 169.254 169.254
Existence of folders that just go to one of the folder
It's the latest
Let me type it
Sade has three Porters Dynamic major little one I'm interested in
Margarita
So let me provide that then it has because it has
I just go inside. But it look older
It didn't. That are 24 that info and security coordination
Security credential that is a 1/4 and 30 sec to
Sdd Donley
It has a temporary credential like X stitches Secret
Session token and spawn so somehow if you're able to identify
Able to get these temporary credential then we can do damage powder
So I already explained that we can have
20th with it and the seal is also available for the electric line
Install disc levers bawselady on
Funny books
Then we can simply inevitable mission
Supported him to explore this environment variable in your machine or in your tummy.
And then you can simply check let's get colors
Formation of the pellicle tokens
And that is 8 lbs in a script so here if you provide the temporary credential it will go to each and every
I'll be so busy and it will check the excess of the temp
If it's able to identify any of the information display to you
Lattice
Let's
He has them to identify next odisha.
Exit 2-3 bucket and download this application.
Action by continuous deployment by play
This
Supposed to be able to go to the Snapchat.
We have to go to
Loud
Stock information from location
Anybody's to theaters
For that let me replace this page and 26 mystery picture first now
The simple things you can try by default discover status page is not accessible from the internet
All its website at the moment you try to access this page it says that for me
You don't help on mission to accessibility
Liberty
Server status
Yes it respond with this our status page that means it's vulnerable
Amanda Taipei
Poop iPhone so yes
So let's try to get the temporary credential
Latest o directly Within.
Aiden dietary scientologists which LetterSchool to disarm
But then that go to the security credentials
Olustee AWS elastic Beanstalk easy to do
At the moment we send credit is better today. As a temporary credential
Mexicali machine
And she'll let me expose let me set the environment variable for this terminal
Awshx sgid is equal to
Increase Texas export aws63
Access key
Is equal to
Bass
Explored
AWS station
Is it cool to do
Mountain nesting Israel to identify the region as well
Variables
Information from this metadata API you can simply go through this latest
But in the latest series of dynamic Dentistry
Instance identity
That is a document directory
Information as well because bunch of information like account ID region information that enjoyed in
Winston-Salem Salon but we are interested in the region ideologist copy this information
And also export AWS
54th Legion is equal to this
Okay so the next thing is let's try to check with S3 bucket
List using this information
PS3 Alice
It says that existing I'd you do not have any access to any of the buckets but
If you look at the documentation of elastic Beanstalk
Like this
If you look at the documentation of elastic Beanstalk
Any scientific information it says that Grandpa music by missions for the application to upload lots to Amazon nest
CN debugging information to Athletics play
Formation is Jetstar distar put object
Resources I've seized that allow for the resources which was name starting with elastic
Install Okay so
If the bucket name is starting with elastic Beanstalk that it has gate list and Bush
Apple pie mission
Go to the documentation of this elastic Beanstalk and then this is kind of the application development
Clarification and it will keep our temporary pocket storage
And then there's a specific name the bucket that is created for us
Wingstop
If you go to this party love you all
Copy.
The next thing is yolk identify the name of the bucket that is available
Okay so it says that electric elastic Beanstalk 3x and an Amazon S3 bucket
Named elastic Beanstalk iPhone region iPhone account ID
So let me copy this
Nohea Beauty quite two things but so how do I identify
So you can simply use the method API Garden to fight this if it go to this point it has boots
Information like account ID
Engine information is this
This is the default instant created for elastic Beanstalk component
What I do now is let me to again
List down all the content from this particular S3 bucket
Be content on this particular bucket list
Get an update on Mission information
Elastic Beanstalk
Before that I'm using this EP, EP 381
And it's a copy
So what is this
And this is and I want to download it
So it's downloaded all the source code that is stated in this bucket
No
What are the bucket that we can upload our Publications
And if you opened I've been Wild.
Document and it's nothing but application so sport
This that means what it's contained the PHP code and this BHP code
Accessible from my cloud instance so what is what is
Upload a bottle over here.
People instances of permission as parents Weekend Update
Fordite
I'm just getting one basic rapture
Let's see stubble
That's an 80 85. BHP
It's a basic BHP adoption has 103 it has
Our name which name is call WP pastor this call parameter simply
Boston T system function
Lorde next step is to add this option been in this gym 50K
How do we do that
Phone that you can use the zip command like see if Ivan you are
2019 the name of the C5 and I want to add this
Edit
Know if you want to check that you can simply again to VI 2019 and you see
I've actually salsa uploaded to death podcast
Calyptus closes now the next thing is you have to upload this ZIP file on DD4L
Elastic Beanstalk
Okay and he has the sources different destination is RS3 bucket
Source is 2019
It's uploaded on the server okay now there is a concept of CI CD pipeline
It's basically Nothing But The Continuous integration and continuous deployment
Application administrative it deploy that change on the light bucket
Call Eli gravitation
On our position away
Let's say to access out of action action CU 85
Hphp call parameter is nothing but
Etsy
Alice
Cuc
We are able to upload our website and we are able to perform.
Pokemon Pokemon
It's a who am I
So this is how we can perform be
Elastic Beanstalk based on the documentation of the last eclipse
Give us the temperature in St bucket on which we can upload
And the default ending convention is elastic Beanstalk hyphen
Legion iPhone account deleted we can simplify using the method
Option on which the application is created so anyone has any person in this demonstration
Okay so now next move the next topic
The next thing is function is a Tubby's
So which is also known as the survivalist amputee still in the picture but he has
Have you do not have to meditate because it's managed by the cloud provider
Bus route to write a function based on the language that is supported in Turkish government
And it's obvious to order invocar function whenever DL Edition
Okay based on triggers and events
You put that into containerized environment and once the exhibition completed will destroy this particular kind
Penalizing moment he is not managed by the function is stories and being infatuated
Only phylum spending trigger solitary events stranded and events
SRP multi-party Garden events supported by the cloud provider so let's stick example
Salt Lake City events so it will
Based on that it will
Call a function and do the processing on the particular request that this is how they should be three girls and
Sending this to this beast that's event entry got any document is uploaded to PS3
Bucket storage and they stop.
And the function will do some execution and then destroy the environment
Stephen events Sushi available the new record is inside are deleted all accepted it was John.
And hello dentist on the table.
Message to Bist events notification Service events and so on
No disability different use cases of the bed from where the events are related
Events at the function is to service the sky that is part of selling website an API events hosting
Image and video processing imaging video manipulation sahil thesis example of
Two-seater time uses their WWE slam.com chien-po image processing Savannah velainu images uploaded in the story
Anybody speaker and the function passes the image and vendor
Different different result listen for the same images and based on that display this images today
User like iPad User computers user mobile users and so on
Example of continuous integration and continuous deployment
Application Android and allart and based on that it will deploy our
Application to the live environment
So let's talk about auditioning data extraction so here
Standard example of erisa documents
Like PD feiffer JPG file is added to the bucket and 168
80 ^ 100 country
Wendy's Palatine the data is extracted and added to the Apache wedding Papas
Decision
The first one is this the second one is this okay
Document storage and Ella
The first fountain get executed which basically
Use the oci the information and verify the document
It contains the pi information
Danny please execute the another function okay if it's not contain any pure information
Upload to this dollar
Now if it sent into Pierre again
Function
It's basically must only be information within document and then store it in the
That means it's over an existing document within the bucket over here so as
Wendy's updated again and again
Commission Now this time tpi's Master by this function
Uploaded to this function as a service works
Difference between the platform service and the function is a service associate
Interpretation but in case of function is service Bo to deploy only single function
Sobeys the somebody's always up and running all the time but in is a function is a service it will
Run whenever the event is triggered and once the function exhibition completed it will turn down.
Containerized environment
System and everything will end up like him but in case of all this madness by detour
What's the weather
Different test cases of the function function that means there is a
Identify the time all the time or related issues
Then once they've done the next Edition could be on the different environment all together
Says I mentioned that one speaks the function education completed will destroy the container right environment
The next alert is undeterred that means it might be running on different environment all together
Now it's running into containerized environment that means there is a container that could be
What's applicable to this increased attacks office due to the complexity
Because that is not only single function that is there within the organization died if dedication
Then there are lots of function available
Admission on all the functions it's kind of a difficult are okay so it will increase
Sopes because of that but it looked complex complexity
Expedition
Kindergarten game
Texas to S3 bucket and connect an ec2 instance the challenge
This
Let me go to my calendar shein
End
Go to this lamera supposed to be able to identify Spotify.
The piece that's it
It's a stranger
Yaqui pocket into a single coach
So yes it's deflected over here let me do my b
Now let's faceting volume 25
Simulated on the summer or not say yes it's okay
Note the function is a services available in four different program
State select instructors let me pass away
Afdah.net
Diagnostic 26. Start start the cmd.exe
It's not working now let's try to use the Java runtime class to check
Weather
Execute alkaline download
No it's not raining
X Sonic simple Bill to use this system
It's not raining now there's checked or the Emojis
Smoothies
The moment we try to 1790s day single line one-liners pictures responded
How to put up that particular service
Within the limit of functions environment variables
It's been too easy containing the temperature in Chelan
It contains
All this a regular Angela KW secret session token secret key and so on
So now we have this so let's check what information it has
Okay so poor that let me quickly
Set those environment variable within my July
Export uws access
Is equal to
Access key ID
Do Justin Bieber pesos together for the better visibility because you're it looks clumsy
Rihanna and informational interview pictures it just display
All the environment variables just doing that
Bandon extinguisher Texas
Kws secret access
This export
WS default
Teaching is equal to
It mentioned already canceled it just cop it is busy to export AWS
Fishing
Is equal to
Navien said all the information so what we can do next
Okay so the next thing we can do is let this down the buckets that is available to
I'm just running this 8st Ellis
So it has this particular two buckets available
What you can do begin Google and buy one for each and every
Let's see bucket and download the source code and check what information is in
That supported that. Just driving distance taste 11 and asses what
Information need us for that what we can do again we can simply use this thing
Extreme College match download information
I want the storage within snss selected 11
Genesis
It has only two index file you can simply analyze all this content
Identify the sensitive information on what application
Repeat the information that is dead within this limited ammo
Wsst sink
Less less
I want to download information that is there within this pocket
It has
Locate Vision nsa's Lombard mouche by
But it also contains one time fee which is kind of a solid object
And get it during the during destination of my cloud account right
Police useful to do SSH into a box okay so how do we identify that this
How do we use this particular file
I sent it into a box because indicted city Party public DNS name so how do we identify that
Cnsnews
AWS ec2 describe
Instances list down all the instances which is accessible using this temporary
Prudential
Anthony saw me shoot describe instances Bible
Okay so just downloaded this let me save it into bonfire
D.
Let me open. Padilla file and let's check for that AWS
Nemo Becky e
AWS ec2 solar salad to search for
So it's not able to identify anything within this disturbance
Mystic EXs against all position that is available
You might don't know that you are the nation has multiple resources into different
Let's try to get instance in the different and different region
Support at what I do
Changing my default region information export awsd Ford region
Is equal to u.s. East
Instead of two let's just I do use fun and let's try to do this
Evanston
Know the moment you get the 237 stands for this particular region you will identify the penis
Able to identify within one of their sleep
And he has mentioned the public DNS name
Do the SSH into the glove box
Call dad again
Tell me the simple syntax that I want to disown you
Okay
Copy this information
82 West Asheville to replace our vampire named select me quickly
It's the same or not I'll get this information
Beasty to IKEA
DNS name
That we can also capture it from here
Know how do we identify this using but this username is kind of a different user
40 box of the Linux box and you can simply go to the documentation
Body documentation of
Diablo okay so simply
It has people username available to the different different operating system like about Amazon Linux 2
Is it user is it is a scientist mmiw
If one is not working then you can try all computers username
I see you wanted to do this position to that particular box
It's kind of my miscellaneous
The moment artist
Buy least has a bad formation formation
Information to the other user as well but as for the documentation of the
The image on the AWS it says that it has only read permission to the owner
Baseball mission to ducky first and then you can use that but I guess I'm just
Yes it's the same key
The moment you said the permission to correct permission you are able to do
If you do use a gym playlist Lexus a ipconfig
If config
Isn't this is how you can also performed Expedition within Continental service
So anyone has any question in this demo
Okay so now let's move to the next next one
The Boost acceleration is cloud
Cindy for the level of access to the current opened up your bid for the temporary credential
Let's see what next so using.
You glide into Network or the bucket to give access to be able to go to the change
The different different region if you could check what pocket we can access using that particular key
Identify the buckets that is accessible
And simply go to each and every pocket there might be a possibility that you will identify the other okay
So you're two again go to animate all the information using the newly-discovered key
And by doing that once you done with the nutrition you will get the overall poster of them.
What all packages are available for the organization what are the other function
So all the components you can identify
You have identified multiple accounts
Not that much help until
So here are focuses on Google instead of running to what's dominant win as in
I don't mean and goal is to control the entire
Marcia in case of cloud our focus is on the ghoul and they
Example of such goals
Nice compromise what other components of the cloud of the specific organization
What are adults that gets exposed if this particular application
Is anyone Connexus the secret if the application gets compromised example of
Schools
Here now let's discuss about a very interesting case study
About exercise session in the containers that is Shopify so here
What happened at least until he's able to perform the service request forgery in the Google
It's a previous version 2 version 1
Celebrities at the time he's able to create a store
He's able to edit a password. Liquid file which contains the HTML code
Injectable
Bottom eater he just inserted dumb attitude IPA URL
No the backend wants to install Xtreme so it will create one screenshot
But he said he's able to download the screenshot and within the screen shot it's in the gpg 4 minutes.
Did you see information but he's not able to identify what what information
Opera m is equal to Jason Isabel Isabel to the metadata API
Respond with the output in the Jesus
The beast on that he's able to open soon information about
Literally has identified that physical environment information Alyssa 10:27
Which basically allowed to query related information from them
So he just specify this Padilla metadata API
Everything is possible. Liquid in the moment in the back. This end
Instant it will vary this information and then it will pass through this
So by downloading be able to identify so many information like
Atlanta tickets blind
Vitamins
Decided to punch out.
AWS digital washing PocketCloud Oracle plowed and sown
No further research is able to identify that using
This particular, he's able to list all the foods that is there within the cabinet
Are you service account to buy fighting these two particular, so there's don't information that is available
Patty stump using tomato plant certificate blind key
Certificate is able to identify the service account token give him access today
Bonetti's. Are you able to take a shell
Lt-col benetti environments
It's kind of interesting scenario where it's a brief story about
You're so stupid and modify the template within the password. It could file B injector the script of the metadata
Installed exchanger which athletes have it with Lids store with the Snapchat
Previous step over here and information
Nikki's musically result of Demeter
Victor the information within the Jason torment as the oil is equal to Jason parameters also supported
Then he's able to extract information is used to excess of dokkan dokkan environment and
He's able to attend the kubernetes.
Able to get the excess Weekender Shopify container
No again this is an example of
Using the metadata API he's able to obtain this information like account ID region security
Presidential Enzo and once he's able to get the temporary
Buckets that is available
It's okay it's an able to expose another and
He's able to integrate instance to identify the higher power tools and open access to the tools
Instances by up a the baby obscene guide
Auditing tools
Want to do a cloud
The first one is csudh is a cross cross platform provider
Can use this tool for the different different plowed and Muhammad
Bodysuit of the Google Cloud it is just out for
The answer is your car and Azurite so you can simply use this tool to do a confirmation review of the cloud
Okay so
The next topic is Google talking so people jumping to this one
I think we are heading to the coffee break I can check how much time it is
Give me a minute please
Okay it's still part time is left so let me cover this
The Google talking so how do we use the Google docking within the cloud
Cloudera again known as the Google hacking which is kind of
Powerful credit that we can use in the Google search engine to identify the football information
How do I identify the security loopholes into consideration or the code of the application that we are using
Example of such powerful Perry
And within the URL I just find evil password on logging So based on that
If these don't that we are able to identify the log file which contains the password
Do you want it and be able to identify information about bfr condition
He's nothing but a powerful Google search inquiry using that we can simply identify
Disputed Lupo's fortification audio organization so using the Google Doc
How can I take a use and misuse the Google talking so using the Google Talking weekend
Simply expect information about the username and password belongs to Devon Collision you can also
Identify the email list specific to the organization across identify the sensitive documents or the document which country
Is the sensitive information identify financial information
Website
How do we use the Google talking for the cloud cloud
Has a specific domain created for the different
Okay so
Like 4. Name call windows.net appspot.com 48
Amazon.com
Reported any component Alex domain from
Whether it will create for us and that is
Go to just going to let the S3 bucket than you do. Stop doing for me and him something
MnDOT SV. Amazon.com
You do identify the misconfigured cloud services in the Google docking Bays
David Dominic created when is created for the user
You can simplify this kind of google.doc very light S3 amazon.com
I want to identify all the S3 bucket that is belongs to that particular organization like
Abandon someone has okay
So here we can identify all these three buckets which is belongs to this organization
Can simply identify the static website using this particular
Kind of powerful fairies in the Google search engine to identify the football information
The moment you do
You can also use the other platforms like YouTube you can also search for APS
Secret or the secret key or let's see the temperature
Available within the opposite list sometime you will identify the sensitive Keys belongs to
Cloud component of the specific organization within
How to use the heat up to identify the fruitful information about life since of information form for the patella
What are the services that is running on the side where the organization is done the application
Can also use the archive.org it's basically used to replace the sensor centage information from the older version
It basically manage your version of the application so I can simply use.
I just using this
As my Google account from Google Play to S3 hyphen star items
StarTalk aws.com equal okay
With all these people file
Basically has this particular side possessed okay
Contain
Beyond the credit policy the database schema has evil creation Perry
Insert a court query update information so we can identify
Information like password user information User. And so on
You can also search for a little secret Keys based on this kind of Syntex like side is equal to
Svi pinstriping star ocwen.com
Search for pcw secret
Information like
URL pocket parties Mansion to what year will also identify bunch of passwords belongs to.
Application is using
You can also identify the league storage account keys on the d-top
He can simply search for this particular kind of keyboard select people and points protocol and type is equal to court
If you don't pass the coordinates that identify these people Empire protocol
No this is kind of important keyboard to default in points protocol it's kind of important keyboard
Environment because it contains the information the account name
Intercounty it's basically used to connect to the Azure storage
If you are able to identify this kind of information belongs to a specific organization
And simply use this information to check whether this article said is exist or not if it exists and you can play with that
Particular information electrical components weather
Extract the source code for the functions from the storage Account app not supported
Santa Peter using the technique that the alarm and
Remote code execution by upcoding of option
Did you play with this exercise for little 15 minute then I give you a box around this and then
If you have time to complete this exercise meanwhile if you have any question can simply self
All can simply post your question with body in
And I think we are heading to the coffee break as well so what I do I just keep
It's coffee break followed by 3:15
Eating over here we have to do is be able to search for the guitar for this particular strain
Within this Frame if you are able to identify an information than you could look at this information
Information that is there available on this particular account
If this particular account contains these people and points protocol information than you can simply
Please use the Azure sea live version that is available in escali machine
And you can play with the Azure Cloud environment as well
Once the hint you can simply use the offline answer sheet and I also upload
Did the steps on them the portal so you can also take the help from that okay
If you are unable to understand any of the steps or let's say any information that is mentioned
Send in the walkthrough document then you can simply pay anything else on the Paris Accord
So let me start the timer
Coffee break
Exercise babe
Everyone I hope you enjoyed your coffee break
And it looks like only one person that's completed this one but yes
Wendy's
Then and again keep your time to competition
Border X
GitHub so let me go to get up
You can also use the Buick up for the juicy information site and your vehicle search for the string not supported
It's just search for spring
That is no response is associated to this publication code is not found, it is not there
Respond user that is there for this particular
Okay so now found one user so just go to the
Is your storage
The moment you go to the Spaghetti Factory it has one file and that is local settings. Jason
At the moment you opened I can find you can find that is 3410 points
Mention that this particles
This particular keyboardist peacefully useful contains account key to access PC
That is that is dead on the issue to hear me
Celeste check with its ability or not
What I'm doing
Jack's brother this but I'm fighting this
I want to check the storage
I want to take that to the sad Sherry's exist or not and the account
Antonym
Found a panini is equal to
It's dated from here and account
Is
This
Monkey is this
Nini's equal to cocaine scene
And a tendency faces yes what next
Download Alexa. That is better than this
Again I fighting this public storage
Now I want to download information for that I'm using this particle command download patch
The account name into key name is same
Open this information
And look at before downloading or before fighting this command let me go to
Usher
Knowledge me star
I want to download the information that is there on this particular share and for that
Destination is equal to my current trajectory and assure source is equal to
Name of the shed under these this
OK Google
And it's paid for sometime
Sometime it takes some time to complete this trailer come out
Facebook 102 minutes
And that is downloaded all the information that is that on that
Let's analyze what's inside.
Hey Jessie.
Electric
Good morning to go to this time
WWE
Monica check for district 41
Has none. CSS file which basically responsible
Looks like some of your
Let me give you a demo based on this to the one to the moment you put this information
CSX contains asp.net core which has some basic data like
Exit 10 in college one parameter that is named
Do the do provided within the name do some processing and then respond it
Hello and the value.
The name of The Pedestrian or in the request party so we can simply replace this information
Asp.net Style
Creating
Just coughing DaVita fletc
B w w tooth HTTP trigger
What do WWE
Applejack
Any defiant 100
Now I'm just copy the data that is buried in there should be good 12
100 equals I want to modify their undersea SX4
Indecisive
Destructible hd1500
And didn't I I'm just open this land rcsx and at what time
I'm doing I'm just
26 notches so what it will do
Ecmd parameter pass
The information for this particular function
And here we can provide defiling
The document is nothing but
All at the same Department
Now the next thing is no information on the server
So how do we do that
Let me go to the first tomorrow
But here instead of upload batch instead of download Bachelorette say I want to use a blood patch
Upload page account name is this account key is this
And here the destination is
I want to upload information on this particular share the destination is
And the destination Park
He's let's a site https ww.w
Route
And it's 50p
Because
Undertale created
And the source is knowledge exchange Source information from
It's fitting.
Newt band cloud
Ensure
An individual that is a site
WWE
And then.
This one I hit enter
Expect to upload RX100 on the server so the next thing is how do we access
How do we identify turn
You are inside
Shelbyville first find the container name associated with this account using let me
So I want to identify the container list with this account
Mesa County
At the moment by this particular come on SpongeBob information
The continent is Azerbaijan post
Once we are able to identify the container name
Connecting wheel to identify the letter download the block associated with this container
Before that
I'm fighting this battle Akuma
Usher storage I want to download the block
That is awesome ship to this
A job app job secrets and is
The destination is in stock. Let me storage within
Blop
Inappropriate ampdir
Clock
Japanese
Download all the information for the article set the uploaded
Okay
Then what we can do when can simply check the host. Jason pilot Isabella
So
But didn't this folder
I'm only 32
It. Jason has the hostname using which we can access this particular shirt
Copy this to me
So yes variable Texas please the next thing he's be able to access this
On the epi22 eat HTP trigger
100
Bedessee MD Issaquah
Let me do it again
Uploaded to
Ww.w
Route HTTP 300
Dixie he says test
And if we do it again
I've been fighting the same come on
In stock that's out now I want to
And the command for back is yes
Update information on on WWE
100
So yes it's gets uploaded what station did the command that
Philip Testa trespass
Miss Northeastern Xbox
Multiple times
Okay so
A comment on this once you identify today's account
You can simply use information to purpose and extradition father so
Questioning this
Minutes to complete this exercise
Meanwhile if you have any question can simply poster question on the basketball Channel
SMS question
Exercise please update the polling channel channel so we can move forward
Is the summer people are still doing this one so let me in 5 minutes
Do small computer desk exercise place after the Bollinger.
It looks like some of your completely spun and some of your students odo's non-compete
And if you have any question just for clarity in the email
It's kind of easy but very critical content
And many more
Certificates including diva
Easter day around Diego
Amazon DP Netflix issues
All the third-party lipsticks
Determine all of the bucket which contains the sensitive information about the Netflix user okay
There is no permission is implemented to this S3 bucket
Schreiber case contains all the information presented information about the Netflix user and
To get back to you soon
The definition of command you to go to this particular block
Two-letter read about read more about this
Next topic
Function that we can use while creating the application to decide
Which part of the Ws and warming do you want to give access to the user with registering
In your application
This is a service which enables direct access to the resources or the application user so they
There are two part of it the first one and the second one is the identity pull this user
This usable is nothing but this is a user provide sign sign up and sign-in options
This uses to design sign up inside interfaces for defecation and excess and Menace used
The data which enables developers to Grant and user access to the aw
So that it will create unique identifiers for the user
NWS coquito mainly used for the mobile application where this identity pool has a random you ready
And because of that it's difficult to group for vaginally this identity
But generally this identity pool you ideas hot water in the ocean
Tradition due to its Department Of The Blind Side
Andrew has done a very good research around that that he
Identify the AWS, he just done the analysis into B internet
And he just replaced the crowdsourcing by accountant and check all the
Regional Dental application download all application decompile to Central education and collected
2404 identity pool identifier
Nobis tan exploding deformation on each pool identifier identify that
Born in fire WWE not insecure where 1906 SE bobcat
It's been contained sensitive information and identify one 1571 72 level of function
Exposing at least 78 sensitive environment variables
No this is a disaster default continuation of the cognito
Conditions that needs to be required to exploit this where pm has ephedrine
What sign up is not disabled and and
Ice created for the user which has a minimal or less privileged to
Anovulation the bucket
And to both of the attack began use this Appliance Appliance which allows to register
Application option we can confirm our user ID
For the application Oliver assignment error but when you send
Cadential application if you want to
About it you can simply go through this block that we have published on the second added playlist
Saudi Saudi Pokemon using sensitive explaining the command let me show you the inter
The entire approach approach to the second
Compromise Alice exploit the awm
This is a tricky precise to let me give you a walkthrough first then I'll give you a time to complete this exercise
Sahil music starting AWS Cognito Miss configuration failure to identify
Secrets
Call Neto.
Okay so let me go to the boiling point
And within that
We have to go to this flower
Angel
Use this application when we actually look
Option to sign it
What you have done by simply doing W pesos
So within that is a bunch of transcript is included
Zip code for jQuery then there is a source-oriented the dumbest people
E-Town supporter and the name of that is an Amazon company.
Please be able to identify that it might be using Amazon Cognito in the back
The next thing will be identify
Borbet in Cynthiana lies all the spice like this one
So a test not any critical information go back
Okay.
It's also don't have any interesting information
Any sponge of Cognito related information is available
Client ID identity ID
The next thing what we have done we have to sign up using this information
I'm using this Butler,
I just walked through the entire process that we are both 14 apply okay so I'm just using
Show me biography service and I want to perform designer
The client ID received
In the Javascript file is this
I want to create a user with the username that say
User 85 + 38
Neil enature.com
Bad Name the name of the name is
The venue is let's use that 85 address.com
And the name is username is let's a user 85
Try to run this tomorrow
Is a hear another thing that will Dimension is this where to mention
Baby Jennifer
You can simply change in environment variable
Kid Pix old AWS
For teaching is equal to
Nick Mira
It might be something to lose my DNS disconnect from the BPM
My penis configuration
Configuration by configuring
Just got bigger
It's already exists
Stop
It's instead please confirm username
Sent a note to be valuable to this particular user
Westfield to go to our email address
Mediator
Who's that 85
And you see be able to receive an email it says that your verification
And isn't that it says that your confirmation code is this
Let me know
Okay I want to use the apartment Garden
Lb7 to confirm designer where the client ID is this
16 correct username is this
Maybe ninja.com
So beautiful and the confirmation code that you have received on our email address
Is this
So now next Dental Medusa
Accept the confirmation code did not respond with anything that is contained in the air
Send Dad a message so it just accept our confirmation so
That means the same as in Abbott in the parking so now let's quickly verify whether we are able to login using
User account. Not in our application where the sign up is not allowed
Wake me up
So Hear My email address is this
And the boss what is this
It wasn't your big steaks
Me too.
F****** let me provide my username a copy to username
The password that have / 3/8 in the username competition Commission
Installation and siding
Successfully logged in but does not have any
Predation or defecation you don't have access to this application please contact your dad
Administration admissions
So now what we can do
The moment just allowed to Allah Kenny 1213
Decision token so how do we access the stupid the moment you go to this
Left console
Atkinson is in the storage within the local storage it has created bunch of token for us
A place to contend that is an identity to cut so this identity
Copy this information
Beastie Boys
Messy look at this it looks like a JWT token like to write the first two components of a 64 and Cody
Valium
What is this the second estate and the tour 2016
Score.
It has bunch of information so that uniquely identify user information instead
Subsafe Beauty image verified is true events
Information
This is important which basically issue despotic
No we have a token and you have issued information
You should be popular talk-to-text
Listen to it and authenticated Cognito identity ID
Pool ID and identity full name
I'm just fighting this buddy. Come on
I'm just using the endpoint which has issued despotic Atoka
And I'm just riding
I said that I want to exchange PM identity where I want to get ID for
Identity pool ID that is fair on our application upsers
This
And that is
Issue information and the to contact information
It just basic whatever
Don't because created by identity
Eid for us now what next
Obtain a temporary credential using the ID token identity
What I'm doing I'm just fighting this Padilla come on
The here again I'm using the same company to Identity
Then I want to Temporary credential by the identity ID that you're over here
For the login that will identify the ID token is this
Opd's replace it with this ID
Strongest woman to obtain a temporary credential
The moment we do that we are able to obtain a temporary credential
Vitalchek what success in the parking all at what exits of the blood component please
Temporary credential has let's just use that
Temporary credential supported set the environment variable for this temporary
Potential exists Eid is this
Uwsp create success
Play to this
WS session
Is equal to
And the people are 3-g news
Is equal to
Identify
Ed from here
Lips are to check the Secret Service let's try to check or identity
For that I'm fighting this gone
STS get caller
Identity
Yes we are able to obtain the information about user ID account
Add intuition
If you can obtain a secret credential are the secret to confusing
Information that is available over here
So next, I'm typing this let's I want to secret I want to use the secret manager
List all the secrets that is available to display
The secret
You're missing an ass and secrets
Thanks so he'll be able to identify the information
Like the name and description last changed it and so on
The next thing is let's try to obtain the information all of the key based on
This loud API
I'm fighting this battle by the secret ideas
At the moment I do that I'm able to catch the BET credential like secret stream which contains
VIP username and password that is belongs to this particular information like 6
Open using this success manager
So this is how we can
Once once we are able to identify that it is the custom is configured
In the back and then you can simply use the sign-up option and you can simply
Then we can simply do a locking using the login you can simply
I didn't forget token which has a mini Milorganite exist if it has the people competition
And this phone that you can expect this from district manager
I believe this atomized clear it's very complex
Exercise to complete so I'm just give you a 25 minutes to complete and if you have any questions
You can simply post your question on the ballot support Jenna we are happy to provide a solution
Also stars on them so you can also text
Help from Attica man help from that particular document or you can also use the offline version of Dance
Innocent looks like people are still doing this exercise and it looks like a very complex select
To the next one
Please update the polling John Legend and if you have any question you can simply post your question on the power supposed to be happy to help you
It looks like most of your computer system yes
Let's move to the next topic
He done with her cloud pentesting
What is the content management system what is the Commonwealth Liberty that you can find in the CNS and what are the
Who's that is available at the article tattoos that is available to do the CMS pentesting that last released
Isabel Patterson testing methodology for the CNS
No I believe everyone knows about what is contained within the system right it is a computer
It's basically allow us to create modify and maintain the digital content from the Cintas Center
The face and the people on example of such a CMS East
What is Joomla type of tree and many more
What is the advantage of PMS
Development of the verification without creating some stretch while also having a community health
Al VR stuck at some place we are unable to create application
Beautification so it's it's it's been one and there is a community available for that
And help from the community as well to solve certain problems
Locate investigation using the CMS and the solution is also available within the community
Do you have your to perform less maintenance because since be able to
And the security is also being watched by the community itself
Identifying the CMS
Celebrities that we can identify in the CNS and the first one is a security max contribution you can also identify
Identify the audited plugins version or little software which is what
Did I start in Times Square technician interface is exposed to
Today internet for PCMS in also identified
Mission based on the team part and points of that is created for the users then
Identify the Departed prevention which is used to configure PCMS on the letter
You can also Identify two people file that is not removed after being stung
Relation object
No skin so this is the automated to now let's talk about the tools
That is used to open the metal penetration testing all the automated testing to taste this year
Application so let's talk about the wpscan first is the automated
Standard tool to find velocity with into Bartlett's application kind of berry
Is that it on PMS application Ellipsis EMS
Create application without creating from scratch
The Beast and is used to perform the automatons cannot be buttface application
Used to find the following information like the workplace running version DeGrasse identify the audit plugin
It contains certain let's see me and they start that we can perform piatek
On this application then we can identify identify the sensitive files and folders
Physically remains bad after installation
Defile that needs to be removed after the installation or we can also identify the admit
History in interfaces exposed to the internet
So office can be performed in the workplace application
Business investing and WP using therapist can be can find this man information
So how do we use that soap to use the wpscan V how to Simply find this
Wpscan Daniel to provide Turles created
It's about this in order to Let's identify the plugins or the username
Pecan Park pecan simply go to go through this particular tool and you can sing
Applejack what are the options what are the options that is available Within These two and then you can
Define double birthday suffocation
Using random user isn't you can simply use that option instead Indonesia
Can you as a New Age religion user agent for each and every request that is fired from Disney
Wpscan resume skin which basically automated
Find the velocity within the jewel application
And using resumes can we can find the gym Ladonna version political outlet plug-ins if its uses
Any find a sensitive files and folders similar with the wpscan
Someone that we can use to perform the automated
Navigation to minimum of Education
It is created using the jungler
It's basically used to the tip of the automatic scanning of the application which is
Created based on the Drupal
And silverstripe identify this man information letter
Like it installed in the CMAs installing the CMAs washing formation sensitive file and folder and so on
So the use of groups can be able to perform comelec groups can scan Drupal iPhone
You and you are a lot application then you can also specify the Third
30 ml is a CMS map which is open source EMS scanner that automates the process
Detecting security flaws for most of the populace EMS
This tool can be used to find following information like plug-in installed in the CMAs again the same
We have seen
Know what is the matter you that engage used to go Compass EMS pentesting so
Simply use the tools that have Justin wpscan Zoom scan to scan
Ncms map also Bob extension is available. Let me check
So if you go to this
Extender I think there is a CMS map is available
Yes Sienna scanner it's basically used to let the scanned application which is better top off
On top of this containment system
Okay but why is in
PC
We are able to identify the information that we can perform Expedition products what what happen
Application has blocked each and every informational scurll exposed
Information to the end-user whether we are able to lucchetti's Autumn to skin identify
Application is about Place application application
Not only helpful to you can also identify
YouVersion invalidate existing issue to the volleyball version or the side antifa diversion
Application request and identify the URL parameters which can be modified as a
Customisation percent you can also analyze and identify things and clothes
Games that are used by the application so here you can follow this particular methodology
The ultimate X Games
Thank you can also
Interesting be hardened bcms instance Fest
Bwg stand and you can also
Accomplice watercress
Let me see the interesting point plus Park Place Northville teacher
It says their caliber welcome to the workplace
Okay Center homepage just kidding me getting a space information that this particular application is
Created on top of what what's spms you can also use the extension like
It's basically give you a basic information about the application
The disciples extension is also used by the pentester to identify the basic information about application
I'm just added that it go to
Know when you refresh this page
They said yes if you take to the CMS application energy
85c information about the application
If it's not working then you can Google the menu
Questioning this
Anyone
Okay so as this is a WordPress application so you should drive into wpscan
Okay if it's not about then you should go for the manual approach
10 minutes to play with this exercise is to identify
Available plug-in which basically to this article injection valve
Once you complete exercise please update the balloon gender Jenner
Is on YouTube person is completely swamped this
Is this application is uses the birthdays or it's creeping up on top of the bar Paseo
So let's try to run the wpscan on this particular website
Wpscan
Okay
Defecation
Yes I would love to database
It says their website is up but does not seems to be running water
What on the vaporizer it's showing that it's worth it. It also shows that exporters
Hey
Let's try with the the other options like random user agent
It is doing the same it says that it does not seem to be running that car place
Okay let's go for the manual
Eaten everything using bitched about wpscan detected this as a bottle application okay
Open identify such kind of scenario in your application
Mansion party we start even his daughter
At least okay so the moment you do babe your boob it's worse it will find bunch of ink
Like
The teams that is used by this application like style Princeton that is a wprs suggestion than that
Is a bunch of plugins are available at the first one in Sears mall to w p&w.
So let's check whether any of the plug-in has any of the polarity or not okay
This kind of thing we can identify we can find on the wpscan
Bwwb scan.com
And
Yes this is a game. Com
You can search for applicants while I'm pretty like
You identify that uses this WP
Let me type it away WP autosuggest
The moment weekly consort it says that yes that is 142 this particular plug in and it says that on
Unattended spell injection at the moment if you can back it just forward your proof of concept
Okay
What weekend do we can simply replace rurally Sheeran let's check but it's available plug-in
What aplicar application as well or not so the copy this information
Deceased part of my application or the birth certificate
Available and let's run
Religious pic for sometime
Meanwhile let's let's check for the another plugins and that is Jerry small to WP
This ship with a convincing availability or not
BJ's tastiest tomorrow
I just use this more productive
The moments research 46s at yesterday
Cross-site scripting and the second one is PS4 City
Scripting acting copied
AC to wake you up and let you sleep List application
And that is this
They just copy this information and let her open it in the browser
The moment we open it says yes this is palpable and scripting
Batista
Is authenticated server-side unattended
Inform the internal files
So I can just open the payload that is available on DWP
Information
Bc2 Lisa
Okay I'm just joking faced my URL
Misinformation
NBC-2
It's awp-25s
Let's check our SQL injection identify the
No
We are able to obtain a college education
So this is how you can play with this chair just lose to sell
I want to get the deepest
It's identified that to database in the backing
Reduces the time-based payloads I just checked sometime information from the back-end database
Information to email I guess yes
Looks like a fart face
Yes this is how we win if you can analyze this were stored and identified
Plugins if it's fine
Siberian Husky
If you have any question you can ask a question or you can simply post request already in the power supply
Cortana
Okay and we are heading to the lunch break as well
Speak lunch break followed by 10 minute of Texas eye steak
Total of 70 minutes
And it's lunch break
Plus exercise trick
Also be available so if you have any questions regarding this topic or the previous topic.
Ordering today so we can simply Pingus on the tablet support channel for the question in Paris
Adventure constitute exercise please update the pool in jandel Channel
I hope you enjoyed your lunch break and
Yes most of your complete this one
Next one
The next model is black aesthetic
And we'll discuss more related
So what is Latasha what is Dan where do we look for
Implementation and B is required so the case is nothing but a temporary storage area
Usually implemented to reduce the latency from the web server
Example of dislocation is letter your paulist who stood behind a reverse proxy syrians
Okay so whenever any
Adidas
Indian summer or the load balancer physically create the cash version of the response and Venable.
Texas Two Step results
Adjectives examples
Pacific Park on the web application
Disjointed cast response on the city and server
Zombie
Not this time he has certain time limit employment
Doctor their time.
Again face from the website and then I get it from the internet service
So the guess he's nothing but a unique string that is created based on the electric
Extension Alexa to request content
So if you compare this with the database and it's nothing like the primary key
Cashier cashier received a request
The copy of the cash a response or Institute
PS3 Spawn from the back-end server
Indian holiday
Baptist Solitude somebody here is to decide whether they want to
Fetch this information from the back-end database or not
Did contain any cash within this professor or not contains a cash discount or not
Respond respond today to the user
If it's not contain the cash communicate with the back
And then career time over here over here and then
Forward the response to the user so this is how the concept of caste works
No that's cash you can perform to issue the first one is Alaska that deception
It's basically using that particular time we can expose your sensitive data and you can also
As a poison
Phishing attack Hands-On
Dedication
So what do we do as in Attica unlocked in such a way that I take
Create a malformed request request
Anticipation the victim user and
I think of it amusing that I need to access this particular URL
Send this request to the internet proxy so here
That is no cash entries exist ok so the cash then what it will do
It's Bill Paxton response from the back-end server and then it was gas to respond based on the
Based on this particular static file now
This speech sounds Department of index.php okay
So basically contains user information biktarvy profile information
Mission of the music now
Meeting this idiot box Alice Angel contains the cache key
555
User information of the victim user and it will
Essie exist on the integrated so it will respond with the user information of the victims
Atticus
A dinner second condition that needs to be made in order to expose this that as a deception
To access this particular page like not insecure. Index.php / non-existence.
CSS
The backend application to return the content of index.php
Application framework be treated in such a way that lets a user
By creating ipin points
BB request for deputies index.php it will not check for
Trading file extension
Index.php number 110 the second condition
Log into that patient then and then only be able to
Information on music
BBC got the cash key decision is needs to be taken onto file extension this week
Regarding any of the header that is present in vegetable request okay
Call extension
Based on that our demo be able to identify the Baptist disassemble a 22 access to sensitive
Syndication
Which would otherwise be only expect that cash it.
Colin 8080 login.php
Glng stock as a deception
Close all this tab
Happy popcorn democracy deception
Give me a minute guys
Chewbacchus
So the first thing is
The user needs to be loved
You can simply identify that based on response head okay so here I'm just checking.
Let's say
Staff Network I'm sending this
ABCD. CSS
The moment you try to send a static ball request using that is a hair.
It stays that X gacha miss that means it's not cashed or the server
Busting into a back-end 31st Roxy
As there is no cash into for this but
Extension or the 5th this response from the back and pick up his
An application and then it'll catch the response for this particular you are so yes this is using the cash
Now what Pekin do you must needs to be locked into that occasionally
And now the user is logged in over here now
Evicting user in such a way that it's try to access
Link that is provided by the attackers
Turn on assistant. CSS
Elegant this is a new file request okay so again it will fetch from the back-end database
Application
Ford itek me again start the control over here
Network
At the moment
It will try to
It is somewhat you wake up
Respond with the same information. Let me check the login page
Okay if you do it again
End it
Play song
It's username
Time to recover play music to access login page PS3
Index.php
Exist
. the ccss
Capital music Exorcist let me open up
1 Saluki
Nextbook
The second challenge that the first condition is.
But you already fill this point with the information obtained SRP hp22 respond with the same content
The moment we sent this request using the same content it's responded because
Information of that particular user so yes
And the moment you look
Start for the protocol header it says that yes this is guest on the server now
So the moment as I think I will try to access this page
Badshah
You think we are able to receive information of that particular user
Thank you sir days John Doe
And if you see the request Hitler when he hits it by Dee
How we can talk on the deception
The only condition that needs to be made a state
Reply to access to page after the index.php we try to open light non-existent
Response.com
Condition number one the second condition is that if you try to
Explode the user user needs to be logged into that position then and then only be able to extract
Sabia able to expect the third condition is that
38t cash key based on the file extension disregarding of any application
Audrey best fondant
By the researcher on the paper and by pulling the same after the center is able to obtain the user input
Animation of baby kitten user
No
That is under attack and that is that
Kia S2 gas poisoning looks like this
Beautiful search for the Explorer exploring the court allowing us to place legitimate data in the country
Who touches headers in distributive best friend okay
Basically part of the body
Exercise open Direction ends on
A response and then we can exploit the victim use it
Is similar to take but kind of inverse of the deception
What happened in the deception
Savannah
Musa try to access non-existence.
Cast on the server response get Gaston this hour and then
Existed
Loving queso poisoning its inverse here Westville
Identify the information
Okay which basically your auntie didn't put in the back end for the cat gash he
Identify that Daniel to identify this latest application
Saudi Arabia
We try to poison the application
Starbucks cash it will be
I take requests
Response okay so here is the background applications
Yes the response of the excesses that is passed by the ethical thing whenever any us team
User on a new user of dedication triplexes that particular Page Street effective
Voicemail to detect bien Kitty boot
Which is not a which is the part of the data caching
What we can do with that particular input
Identify the injection cost at crafting and Salon
Inject that information into a cash the once we are able to injected between permit
Information into other users
Again BO2 maps are cashews and I can be able to identify the input which is apart of
Again beautiful
Somehow we have to identify the video which basically inject our response into a
And then and then the other uses
Discount Tire. Next demo
Any unclaimed put used by the application and sour Cash's. Good for the skin
And you do any stores and doors and killing put Fitz malicious payload to the following
Random user Ben
Response gets poisoned father
Location controlled by
Insufficient to remote location control by Attica
Let me go to
That's ketchup poisoning
Here you see it just respond with the holsters
Just respond with your infant information
Song that this information is
Sapore back speech
And if you close this party started right now
Anticipated
No let's list replace this information from here
Bartow
Spider Pikachu
So now what we can do next
Guest on the server so what we can do next let's try to access this from here
Let's check whether the victim user gets everything
The browser
Then again try to access personal page
So it's not part of that particular uncured input but the next thing we can try
Let's try to use exported who's
Which is sometimes used by the bank navigation to closest people's information
Is 1234
It's not updated so it for some time to get gas
Expired from the backing
Bennett middle blisters builders
Yes now it's updated within the Houston information next check as a victim
Musa
That's a potato at the moment we try to replace this page using
That particular response that is based on Bing boot bettuce / 350
Cast on the subway in Venable any application user triplexes that particular page
And just responded that is injected body
Pics of the article user
UCR data speed of injected with industry ml right
Be proactive store knotless check
Say yes it's processed over here
No instances of guests on the sidewall let's try to access this
Tom DVD music
The moment I do that you see a script payload gets executed
On the browser because this particular information is guest on the server
Okay this is Bianca Lynn put up your identify and this information get
Despondent
What's next to the next thing we can do
Is let Sylvia let's let's try to
Supportive that
I'm just saying this but in the head
And here also within the script just reading the information from the wholesaler
For the POC book was created this particular holster that is physically process the input
What here is what we picked up our food then we can also poison at the
About the cash on this hour
The moment we do that using it just responded what your input gets responded over here
Before sending the request for spo2 start disabled right to get requests from the
Invicta machine
What number is 123
Let me delete everything Jumpland site page
The moment we sent this request has expired because bear implement
When did the 22nd timer to expire
It's 4.85 1234 eject my IP address
Yikes 85
You just paid for some time
A knowledge
Afflicted
Wanted me to fix this page it's try to get us try to retrieve information the script information
Because using this particular Heather we are able to poison the distance
Gatsby's particular response on BMW proxy
Bendable any user triplexes that particular page it gets off the content of that cast response
Modify Scripps Oceanside
Describe information from the article storming
Then the next thing is pure distilled the credential
Okay so I can view identify together basically input
Become apart of 2/3 of the cashier
For the POC Papa's feel created this and the third place closes
Buy-Back lifeway.com
Let's check whether it's affected dead or not
And yes it's effective let me start
Request
Let me access the same request again
Oh yeah that means might be possibly that it's expired
Okay
Just not it's up to dude
Can you let me check what I'm missing.
Login.php I just have to post to be
Submitting the phone so it will send a request While submitting this login.php
Yeah! Is different
Restart the list over here
Entertain commission-based taste
The woman who died Texas page
This is how we can expect the web cache poisoning first we have to identify
Which is part of the cash in Kinder parking
View to identify the application Level using that particular what we can do
Maximum Impact if you if you identify that
Injection or content simply
Explode people
Despite Latuda para Miner
Obedient that gas that is so I don't list
Which has so many haters accepted by this stupid list
This header is processed by the background application and it's kind of
I'm getting food and using this header if we do anything with interest points that should be responsible
Expertise
This is how we can become the back as a boy I believe this
If you have any question you can unmute yourself and ask a question
Unintelligible to the next one
Let's move to the next topic
What is Salinas
Celebrities like unicorn animal Edition attack without the second
The alert is like expecting Miss configuration for control system
What is a bunch of Easter
In earlier days the characters were anchored in such a way that it only
Reports of given language are set of the one region was incompatible
Another example incompatible with the English
Do to overcome this issue the Unicorn standard was introduced
No the bunny application uses this unicorns which helps to maintain the countries
Including in the presentation of the character
44 the application and nowadays supported by most of the modification
To identify the parts when converting to evaluate
The first one is the normalized and the second one is stuck when you go there
This unicorn is a very complex standard to understand each character set or
The symbol is mapped 1 numeric value called called point now
On the greater than symbol according you based on this cold point now this unicorn has a multiple and columns right
Unit unicorn 16 unicorns 32 hands on
Used vans application uses the record alligator in the back end so
Fuses in the normalization process it converts
Nothing be composition-type best Fitbit mapping cache mapping
The Unicorn character into a ASCII character
Simple unicorn values
No start something what happen when it was this unicorn is converted to Baskerville using body composition
It's so please
Chinese Japanese looking character has this particular presentation
A presentation utf-8 encoding utf-16 and cooling YouTube.
Supacent
This particular character
Happens to Bent the decomposition happen to that particle collector it just converter disconnected
Decomposition
The factory just
Three person that said he asked you value and then see so
When we converted symbol using the decomposition then it will represent
Eapr small airports last and see
Unicode characters
As I mentioned when we convert symbol using the number
Evaluate Dallas convert 28c M convert to capital M
Circle small is convert to small dentist RedMax in
Is sunlight to Capital DM
Unicode character to bypass application if
Dedication uses
It's application process this unicorn character and convert this unicorn character
Going to ask you while using the normalization process
Then we can expect
Buddy's normalized any precipitation this when this normal
So all this username is different but it all together respond with the same
Play the this is baby composition process required Utica
Composite to Smart you so on Black Friday someone has to
Posted on the support of the Spotify where I can compromise
Begin the Spotify application so this apartment
Give me his account and say please can you please confirm
10 minutes that I knew playlist available with Indie support manager
Sophia bigford sample account
So what happened with the superscript looping text
Like the first requested a password reset for that particular
Like big bird which is nothing but the superscript text
Try to follow the password reset process
What happened is able to reset the password of
Twitter account a big part and dismal big part accounts all the small case
What accounts to hear what happened during the normalization process
What happened to Big Bird's convert student Capital big butt
Reset password first fish this username from the backend database
And then it will perform the normalization process and caps big butt
Into a small Big Bird small cage big part user account and by following this Tuesday
Is able to reset the password of the user was username is in that small plastic particle
So here I just mentioned this okay so what happened over here doing.
Decision process whatever the Unicorn value that is provided by
20 coronavirus imposes and converter converts into a scab speak button it.
A game of decolonization process and then
Deeper Capital big butt into a small cats big pot and by doing that he's able to visit the past
Marcus Peapod account
Hugo normalization attic okay explored the forgot password from 30 to login as user X
Reimbursement. Bye-bye club.com account reset the password
Then again I'll give you a time to complete this exercise
So the telling you all this expense reimbursement.
Okay so he'll be able to register are set
And for that
Let's say my name is Sunjai
Mucinex
Ifcu 3085
Having a unicorn character for that
Let me go to this particular link
So here that's looking for the character you
It has multiple you based on the following values
If you look at this circle you when you click on this
At the BI-LO when the decomposition happened to this particular character
Converts to the ASCII value small q
Valentus coffee this
Hugh
Let's play with us
Circle
Destiny composite to smartass
Copy this information I'm just leaving my username in such a way that whenever
Malaysian processes pain in the back and it will convert this information to
Musa name username
But it's a user this user 85 and threat meeting
Oh yes American millionaires do not have this unicorn support
Gatormail
This is the email address that is created for me at me the copy
I'm just
Using back
And the password is let cities at 32034 East
Batista
It's taking time just wait for some time
Now that's performed reset password closest I'm just going to this login page
Go to pocket password
It says that we have sent a mail to your email
Reset your password so yes we are able to email
Clarification
Open Gmail and click here
Username is this and password is Goodson new address 1234
New address fantasy for normalized
Import ban it will convert user input to this small cases 85
The password of the victim usually along with d
Support. Let me intercept request first
And do this at the password what is not correct
So yes Anubis Feliz you are 23
Answered speaking time to just wait for some time
It is if your boss has been affected or not
New address 134
Is he a new password and username we are trying to use Is Everything music
Interpol
Specification allow us to use the Unicode character during the largest station process
BizTown depression is it might be using the normalisation process in the back and then
So anyone has any
What's this
Okay so what I do let me quickly check
Okay so
And let me see. And let me upload a walkthrough of this on the border
Let me know everything
Takes around 12 minutes to upload 2 walkthrough
Still didn't respond like me 50 minutes
Friendship a texas-sized please update the golden jungle Channel
It looks like possibly complete this list not funny
Adidas love.
Next topic and that is insecure.
News about what is insecurity
It's like a dream.
There is also a second insecure direct object reference
Also depends on what happened in the second order in the second
Ocean Point is different and ignition point is different
The fourth page
Infuses applied impudent the first page and then this user input passed into a second.
And that's that
Value first and then it will perform the validation
40 users authorization
Mr. pita
20 standard what happened
The standard
The first. I'm just taking an example upload expense file okay so based on
The information that is provided
These IDs belongs to this current user or not if it's belongs to
2D expense sorcery speed
What's the ID that is stored over here and Based on data collection department of the five and
History content of fire to the user's browser
Pashto then put in a dispersed place and then on the second place it's been force-feeding
Babies to do what here
CCC letter
Affiliate
Who belongs to this now what we are trying to do the moment we try to change this identical to a
Why do you spell tooth pain in the back and it's unfortunate that this id-1 is belongs to
Al-baqarah 20
Try again later
Idx
What's the first store to Baldwyn gas variable its decision variable and then it
Authorization request authorization of the particular ID
Eat the same thing please for the document X and holds the server response
And as for the process it updated the case variable form
X2y and ignore this point forward
Response of the first request implication responded be content of document by Malcolm X
Let me explain this interface reviews in telestration
So this is a piece of feces
Try to student information and try to park on television
Response from a form and then
What happened here is an article what we can do
Load extends file is it play to identify 21 what
Make an identity identical copy within our computer okay
What is mildew
This particular piece of Cody's HD
Editable
Any pool
So he assigned to one then it'll students receipt ID on in
Belongs to this one
Used Lexus.
Redirect a user to this St
And then came to our first step over here and then
What we can do what we are doing in the repeater which has 15 inside is equal to 12 IDs equal to
Hello again to force-feed is called
Receipt ID from tirupati
Maddie Ziegler
Then it will change the receipt ID within the session variable
Receipt ID indication from 1 to 2 and then it will check for the validation
Again these two not belongs to the current user so it will visit the user today
Philippine
Go back to our sister to the moment before this replace to discover
It will it will first read receipt ID from the station variable okay and
Because we are poisoned in our Stepford okay
The moment digital receipt ID from the station.
And then it will respond with the content of their particular file and the browser display
The content of other user information so this is how we can perform the second order
Insecure direct object reference with interpretation
The biggest countertop next exercise video to explore the second second
On the application who owns
IDs equal to
The word explains ID ezplay2001
Implemented simplify the information latest information of any of the
By exporting discolored so question is this
It looks like confusing right so what I was just
Explain this entire concept by giving you our demo again what happened at what place
Okay
And meanwhile what is Manchester to let me give you a 10 minutes to play with
And we are also heading to pick second cocoaplex yes so
25 minutes
The 4th
15 minutes is a coffee break
The second exercise Street
Searching the coffee breaker also be available to any questions regarding any of this topic
Topic or any of the topping tapioca
Coronavirus China
Welcome back everyone I hope you enjoyed your coffee break.
22 people has Cops 21
Give you let me go to Michael Mission first
Play my challenges
This let me use this
Application running slow
Reimbursement
Expensive to add to file
Order clippy download
And then hit me up
So it's uploading
Opinion this just before sometime
ASAP
Buckets buckets
But not expensive
It has this portable expensive just respond with the content
If you stand on that particular
So let me open up that file and spell
Actual content
Lloyd has all this testing information and that's all that's real
Respond
D.
Duarte below comic
Beautiful music
View
Not before sending this request of little or expense file what I'm doing I'm just capturing this request
And send this to Daddy. That means I'm just creating an identical request
Okay of this particular request and I wanted someone to capture the response and span
Order request belongs to me that means is just responsibility
Extend access speed
Viet work on this tablet making identical. Copy and 4.
Request because id-54 belongs to us expense taxes speed
Holding here and go to the request
Indira peter.and here
What time do
Just replace these ID with what this request
It will poison decision variable in the back and because
If you look at the store score
Enforced store the value and then it died
What is just replace the value of the digit ID within the variable first and then
Addition but by the time of being deportation artstation variable
Let me know what they are doing I'll just forward this request make expense sucks
Is Seaquest at the moment and send this to the backend application
Set the ID from DJs invariable first and he just freed the idea
User and it's been five C content of the particle part and he just responds with PID
Of the 51 instead of this is how we can perform the second
Be integrated ectopic reference
If the only or only thing here to understand is that it was forced to devalue
So anyone has any question in this
I think the demos.
Supposed to move to the next one
Meanwhile if you have any question you can simply post your body on the back support
And Montreal completed exercise please update the polling channel channel is bad
Exercise please update the whole internet
Is so yes I'm still feel comfortable
And before they let understand what is is is
It's emergent control system which is used by the developer to take all the 32
Juanita acordes altercation
If used extensively by the developer to manage the Coronavirus
Multiple people
Anyone can do check-in check-out all this operation
The concept of misconfigured kit is your teeth
Is misconfigured for your application then it will leads to exposure of modification made
25 and older statistically allowed article to download the entire source code of the application
It contains content security credentials sampaguita history
It can also expose the hard-coded secrets that is available within the stores Coronavirus
Credential sometime it also contains B hard-coded username and password
Identify the Articles also identify the hard-coded secret information that is there within the country
Application then we can find bunch of sensitive information.
Honda Pilot
So how do we identify this application is Valerie Bertinelli exposed
So you can be this particular as point from the application
Defecation respond with a betta
This kind of data then yes it's possible to get exposed.
Just respond with demastered Branch information to access this
Plus
20-year just relaxes the hard or switch masterbrand
If he go for this dog eats less wanted than all the configuration for the particular
People
So how do we identify this but there are certain to switches available which basically used to identify such power
The first one is the gift finder which basically used to find some Candlebox
A once you identify the defecation is vulnerable to get exposed part and you can simply use the speed
Utampa and get extractor to download the source code for Monday
Levitation
Tiana bianchini exposed Bob and the second one is abusive abusive diesel
So as I explained
I mentioned that the machine used for multi-purpose ointment application
Asp.net application use this machine key to the encrypted information for the SP.
Okay so if somehow we if you're able to identify that this potato
Induced to perform P buset encryption all attributed the time Christian then we can perform.
Execution using devices and Papa
It is in the clear.
Whether it's up Machina but it's in the encrypted phone so if it's
Belinda clear text
Then you can get expert at the attributes
That is that based on the different different asp.net
If the Mockingbird and the encryption University's false than no other tools required we can simply use
Progenitor payloader next 30
So it's kind of
The darknet version racing 4.5 it also supports demac anybody
And encryption is possible we can use the black Easter to 25
If it's Tuesday is John Deere that using people arrested or depreciate machine key or not
If you're able to identify then we can simply spotted father
Similarly if boots pincushion is too and Mackies to waterfalls for the darkness
25 of the black history stories and still under the future development okay but if somehow
You are able to identify the motion
Do similarly 44.52 use the black history
So this is how it looks like within the body shoot okay so it's the Mac is not in the world
Alone to exploit the vulnerability
If the magazine the birthing reply to certain properties to provide devices to get darknet like
Plantation key validation algorithm Danville to provide specific VSP
I'll explain what it is.
Would follow so he'll be able to provide bunch of other information like application park or let's say depart for
Hbcus is janitor
Notre Dame and validation key
Constipation to husted RC exercise let me give you a walkthrough first then I'll give you time to
Play with ER then I will give you a time to come
Then you'd expect you stay to perform before execution book.
Bless. Kit
Didn't you want to list books
Try to access the beach
Is this is Valerie Bertinelli text. I'm just saying.
Yep yes in the basement information also go for leprechaun Pig
So I can you just respond with information that means it's possible to get exposed to back so now
If you are able to identify
Target expected to download Authentication
Okay let me go to my pool heat pump
VRBO
Do hereby swear to provide the URL
Sportsbook
Look just alike.
Damn you autocorrect books
I'm running this with the 33
Download
It basically instructed that has happened to this particle
All it's a beautiful p**** please and
The entire source code within. Butler directory like books
Folder name in the background application
I'll pick it up before 3
We did that application and as we know that if this is a doctor that location
And tell my piacente information within / 25
Decepticon Big 5
Just Jack Hartmann information
Attached bicycle connection string Portage. Contenders 4:11
It go down you will identify the machine key information
Installation kit and
Go to demand
Music uses the default information so now
What
The information
Elizabethtown theater information we can find
The moment you do login
N2y let's say you are
User information
Just providing spam information to check what are the content
At the moment you checked.
And as we all know that this Tuesday it is translated using encrypted using the information
Using to get exposed for identified
Once you are identified is to information that it's kind of a straightforward put it under the pillow
Cuz I want to play with this request
Before. You can simply use the windows version of the wisest degree.net or simply
Use the utility. Bubba club.com
Black history August 8th
I just talked to his license and here I'm just using the booster because
The blacklisted is useful to identify the keys right but here we have a key so we can simply use the rifle today.
Get your ticket and
It's asp.net greater than 4.5
Decryption algorithm is yes
Identify this
And the decryption key is this
No talking Peach Park
Okay let me verify.
Beach for Beach this music is created and the beach is Place account / login
No answer. That uses extension
Extensible SPD so by the forties uses this aspx extension
Without Extinction and you can check whether the application is accepted or not but most of the time YouTube
Because your data application back on this production
Celebrity Tattoos application
And commanded I want to call phone and that is
Let's see invoke-webrequest
So powerful. EXE invoke-webrequest auris
It's E85 and please extra-tall please respond with the user
Pseudonym from the environment variables
At the moment we do this and repeal or it will create a payload for us
Copy this.
Delete this existing information
What is over here
Teambuilder do a spell to convert this into a URL encoded form
Reason behind. Because the b64 contains this place + 5
It might be a possibility that the backend application apart from the water Dakota operation
Convert 6 + to aspis it is not a valid character according to this day 64
Convert this into a URL encoded form for that I'm doing this
Convert selection URL
And Corky characters with basically converter plus into a letter you are encoded value
I'm sending this request
And that's why
4 time using this
No requests
The moment we sent the request just responded to ponder that internal but in the back
Yes Papa
Kentucky
Filippi's how we can change multiple-level everybody's so the first few identified
Exposed book
And then we'll both come to view straight Immortal execution in case of you
Identified the deputies uses of used it or let's say it's wonderful
Navigation to transmit information from one page to another page then
Next thing we have identified that using the Gita SpongeBob be able to identify the Machinery that is used for this
Two things is in which we can generate or diesel ice pillow
Report abuse to pop on the execution
So anyone has any questioning this
Kind of interesting
David this
To complete this exercise then we'll move to the next topic
University of any question you can simply post your question or Aquarion the basketball Channel
And let me who support as well
Okay so it looks like most of your computer this one
Let's move though maybe not stopping copper training and 36°
This is a technique in the process of Ashtabula Quest handling by the server that are
From one or more users does so this vulnerability often critical
Metro because it allowed an article to bypass the security controls or to gain the unauthorised access
Are two x's distance to information or directly compromised verification service
Do in the morning application to use that equate is coming by a front-end server which is basically a lot
Valencia neurology any Italian team proxy server or five application
Solo
Rent Lord Billing Services direct message sent this request to the back-end server one-by-one or proceeding
HTTP stream which is also known as PhD pipeline
All the requests I've been passing a request one by one in the back and silver
First in first out session
Not an SUV bong. Because how do we identify the back until order this is the first place
Second request is it the 30% to support request
The first one is the content-length cider and the second one is to transform coding Heather and based on that it will identify the bond
Order any update request
No
It will put the priority to transfer hand cutting hair
Wilco 42nd and 10th
What weekend do we can provide both the header to the front end and if somehow
Animal forming sending the transport including header if somehow contended that is not able to understand
Why you even process the content and continental crust
And he'll understand you transfer including value and you can only process the transfer
Including Porsche the remaining replaced is still remain in the pipeline so
Mexico's commitment offended well here and it will powerful I think
Detective as a contender
Putting header then sent both headers in single request which can be processed differently by front
Then in the parking server and this decision can be exported using the following communication satellite
Either you can use the bar extension cord replacement
All you can think of use the open-source utility cards by The Smuggler.
So if you thought the difference for the request McGlynn you can use the TV 2.0 you can simply visit
The processing of tmb groceries and also configure proxy to recalculate the contact lenses
And identify fungi Smuggler request and rejected
So just in case study around District
Smuggling where the researcher is able to perform PCP synthetic on the slack b.com when he
Able to perform be able to steal the cookie of a session cookie of most of the user.
So here.
I'm headed into transparent Cody wear
Dependent is processing B contact lens for and in the back and it will identify the X current coding and
It will process the transfer and coding for so the remaining requests it still there in the pipe
I planned so whenever the news request is Kim it will be offended to determining request
The beasts are in the pipeline
Sobe Stone.
Then you to perform jcpd synthetic to get the cross-eyed script executor than a user user visits
Adele Angeles covid-19
Baltimore
Let me log into the McCauley machine
Go to navigate to this covid-19 website
No this covid-19 website is vulnerable to let's say
Northside scripting image
SRC
Error alert
Document
Location I'm just reading my bill
Yeah that is a typo
And yes it's liable to go outside scripting now what time do I'm just
It's o'clock my request way here. This is
ABC protect its converted into a post
Request matter
I'm just making a post request over here
But let's provide to head over here
For that reason I'm just using this convertible junk
It has both headers contact letter and deep inside
And here I am providing
I'm just spending the other requests and that these are it's a exercise request
Proxy
Open this
And here instead of host I'm just adding one random it say
No
So here in the back and it uses the sun work which basically understand
The Bodyguard
Space to Vertical tech support. If you go to my Dakota convert this into effect
Good places to do a 28-0 see it is nothing but the vertical tab
Opd's header which is not understand by different answer but pain is caused by cancer
Understand this
Designsbyleann coding volume
Nb02
Keep the Connection open
Replacing this page for every 5 Seconds
Noticeable
I like to exercise
Log into cat and hear my username is Sunjai
Logging
No let me replace the beach after 5 Second
Let's try to steal
Cookie incentive document location let's try to
Scan document. Cookie
Text information that is provided
August
Papa T's
It's a family crest I'm just replace the times for them calling her.
The song right now
You see this happen and be able to capture the session ID so what happened here
At the moment we sent this request to the server the front end
Did not understand the times for encoding
Best and send this to D-Back and application sour understand the transfer and coding
And this transfer encoding Heather Orbeez understandable and putting a team from
Until this zero only this information
No
This information is still remain in the pipeline Savannah for a user's sent another request
Like this
Okay so this is Eric first and came from the front end to the back and it will up and deliver here
It is essentially become this particle to get
To send the catechist
And this is part of our custom header which is nothing
Assemble octopuses because it means nothing
These days and when it closes be able to exploit
So this is how we can perform based you could be sync attack
No it's
You should always model photo for dick first so
Unaffected let's see I used to live in point Solitude Samba
Replace an application or the backend application user session
Passing the Restriction but ensure that you sent enough enough amount of request so that other user of data
Will be sitting beside your intended this phone
Are all exercise model of the training
No these are the bunch of history that is kind of homework for everyone so here include
Did this because I hear it's kind of like fettuccine, meaning of multiple
A researcher has combining multiple parameters like No Label or less immediately
Metacritic
Bogbab admin privileges admin featurette allowed to do
Allowed to create a file data file and upload a file so
Been researching upload Elizabeth before Alex not allowed ready to that undercover
But these Wonderful Tonight
Politically 30° outside
That's where he's able to file and that file cats
Is exhibited on the application and then schedule
Executed no using the normal user is able to identify this
He's gaining bootable to drink the admin user to download developers BHP port
And executed within the administration and by doing that he's able to
2 / 4
Okay the Asiatic training
Identify pssi for liability than again he is able to identify
Celebrity pictures of gate best ssrf and within.
Seattle of injection and using that he's
Another request for the internal application which has water able to interpret this relationship
By following this process researcher is able to perform the execution volume a little bit
Don't let me show you the final payload
So this is how he dropped his particular request so the first one is before Stacey salad
SRA reading that he's able to perform the Seattle Seattle of injection and using.
He's able to create the request to perform the Beast
Dad said this study we are definitely recommend you to go through this
No these are the key takeaways for gardening like a Bia Bia Bia
Scooby-Doo a tax office in Immigration that will learn the bunch of Ativan techniques
Somehow we can bypass the data boundaries we have wanted how can I change to landscape
Do the post explanation we have seen the second-order simple injection or the second order injection via bypass
Identify
Exporting backfiring protocol explained that appointment
55 mapping application contact some of the people
We have explored the lab during the training
So I'll be done with all the bodies and you can get the toy
30 days Lexus with painting to the left
And if while performing exercise if you have any question any query
Please send out send us an email on this wspp training at nautica.com for any of you
Glad he looked at any of the exercise okay for Adidas lab.
The portal that we going to Arabic
Standard-Examiner book Porter wp40 training the progress portal that is
Web4 do that paper. Draining the MLS teams John Dollar General in the private support Channel
It's available remote access on the Sunday night and that is 27th March midnight
Is a please copy each and every information that is available on the portal or like the credentials that is
Okay
Please download this credential
Please copy this credentials that is potential for your offline
So all this material that is shown over here
Don't Disco.
No but that's it so thank you all so much
Unsubscribing for this particular training if you have any feedback for this training or the content of
Obtaining or delivery of this training you can simply provide us the feedback if you if you
Filling out this training then you can simply shout-out on Twitter or LinkedIn
Not secure for me, I already posted that
BMX Games Channel
Yes already posted.
Thank you so much all
Through 2128 some clothing notes over here
You guys so much and I hope you enjoyed every bit of it
Also I said be too alarmed by the courses hacking insecurity
Packing up application security for Developers
Hacking and thank you guys joining us
Thanks everyone so let me open this channel 45 minutes if you have any question
Thank you is great
Thanks thanks.
Yes thank you both and while we're sitting here I will add for anybody who has to take their Cloud hacking
Course that is awesome things data science
Hey guys it was a it was fun and enlightening so
Definitely be able to use some things we learned this week daddy love them and thank you so much
You guys take care hopefully we'll see you at Blackadder somewhere one day yes we will
Tayk
Thanks-thanks-thanks James
Thank you
Have a good weekend
Diamond a good evening everyone I'm just closing the zoom assertion now
Thank you so much have a great weekend