Hello, everyone, and welcome to this video.
So in this video, we are going to see one of a very good resource which can be useful for us for identification
of broken links into any targeted Web application, if it is of a bug bounty program or while you are
doing any penetration testing job.
All right.
So if you just come on to that link checker dot com, you can see it is a free, broken link tool.
Now, this tool has been helpful for me to identify a lot of broken links onto any target for application.
So let's try and see how does it work?
So you just need to enter your target.
So, for instance, our target here is broken dot as ask your daughter, X, Y, Z.
Remember, this is an application which I have created and I have kept it to be vulnerable by design.
Now you can choose a single Web page or check the whole website when you choose, check the whole website.
It is going to crawl all the walls onto the target of Web application.
So basically it is going to spider the application, identify all the others and try to see if they
respond or not.
If it identifies any of the cartels, that it will just reflected over here and will let us know.
Additionally, if you want to check only the single page and the links onto the target page, for instance,
Broken Borders are secure dot, x, y, Z, slash, contact, dot, HDMI.
It will only see all the links on this targeted page.
But here we want to see all the links are you are allowed onto the whole Web site.
So after you hit check, it is going to give you a captcha.
So just pass this capture and again check and then you have to wait for it to finish.
As you can see, it has already started scanning and has identified around 60.
You are still now there will be a lot of you are URLs that will come over here that will include fonts,
image, JavaScript, etc..
Now, you need to keep in mind that you cannot pick over those not found.
As you can see over here, we have identified there are a lot of not found and total of nine failed.
You cannot ignore this because these are the resources or the data or files that have been hosted on
the same server.
So let's see something else that what can we do decode?
As you can see over here, this is LinkedIn dot com slash in slash.
Take me, please.
Now, we know this this is one of the LinkedIn profile that has been created but never claimed on LinkedIn
or the profile does not exist.
So in this case, we can, as an attacker, take over the LinkedIn profile page and successfully claim
it this way.
The attacker can also impersonate as an employee of the targeted organization and further conduct other
attacks like phishing, brand reputation or business loss.
So I hope you guys understood how you can utilize this in your day to day job for identification of
broken link highjacking on multiple bug bounty programs.
Thank you.