Yes, so hello, everyone.
So in this video, we are going to see one of the very interesting example of how a security researcher
was able to identify a broken link, highjacking into a company's LinkedIn page.
And through this vulnerability, when he was able to identify, he reported the vulnerability and got
a reward of five hundred dollars.
So let's quickly see how he was able to identify.
And then we are going to see the same proof of concept to identify a broken link hijacking on a company's
LinkedIn page.
All right.
So a very good resource, which is at all flew a brokenly hijacking.
We are going to discuss it in the next couple of videos.
So he used to, which is B and C, we are also going to see how you can use this tool to identify broken
links on any target of an application.
But before that, let's see this interesting thing.
Brilliancy.
See, the URL is the Blue Dot Lingnan slash company and the company name.
So the researcher was able to identify this.
You are with the company name and the response to that was four zero four not found.
OK, so the next step was to create a company page with the above company name, which was actually
not available or was not of any time published.
So you made the company name in the above.
You are headed to Khordad.
So now, as I hope you guys have understood as there is a link page of the company, when I the user
clicks on the link, he will be taken to the hacker controlled LinkedIn page.
All right.
So this way, any messages or any communication or queries that has been sent to the LinkedIn page will
be sent to the attackers control.
And this way, the attacker can also create a business loss or reputation loss for the target organization.
So let's see a quick bucy or a proof of concept of this vulnerability.
As you can see over here, the web application is broken.
Borders are secure.
That files within.
There is a broken link onto this target website.
So where is the broken link?
I have simulated the exact same scenario.
And when you click on the link, so let me click on the link and you will be able to see that it is
available.
Can you see the profile is and available, which means there is no account on LinkedIn that has been
created with LinkedIn.
The same you all and you can see what was the profile in the profile name is if you look closely on
the left bottom over here.
Let me take over there and it is.
Take me over please.
All right.
So now we are going to take over the account that I have just signed up on LinkedIn and I have created
account.
So let me just finish the steps and then we are going to take over the LinkedIn profile.
So let me quickly put these details on next.
OK, so let's say student.
OK, so let's say.
Google, for instance.
OK, so are you looking for a new job?
Not now.
Let's quickly skip this.
OK, so let's skip this as well, let's skip this as well and.
Let's finish this.
All right, so you can see we're now we have successfully created our account and perfect.
Let's go on to our second speech quickly and click on View Profile, as you can see when I click on
your profile.
This is my profile link with this hacker.
Hyphen me hyphen Dubberly seven seven two zero one me.
So I need to change this rate because I want a new order for myself.
So for that I need to go into the settings and I need to change my public.
You are in so let me go in settings and let me see my public.
You are ok.
So it should be in.
Yeah, so I am able to edit this profile, you also just had to edit contact info and when I click on
this, I will be redirected to edit my public profile.
All right.
So you can see on the right hand side and your custom, you are also going to edit this to take me over,
please, and see if this.
And you can see success perfect.
Now let's see if we are able to take over this.
So let me just reload this again and click on the link in one.
So once I click on Lyndy and you can see we have successfully taken over the LinkedIn profile of the
Target organization and now the malicious content will be solved using this profile, which is hacker.
You mean that we have recently created and this is the attacker controlled domain.
So I hope you guys understood how you can do this.
Thank you.