Hello, everyone, and welcome to this video.
So in this video, we are going to see a life of exploitation of one of the broken link highjacking.
So I am want to get up dotcom and I have searched for a query, which is S3 Dot Amazon, a W.S. dot
com.
So this is a specific query which meets 232 repository results, as you can see over here.
Now, these are all the repositories which contains the keyword, which is S3, DOT, Amazon, W.S.,
as you can see here already.
So we are going to see one of the broken link highjacking in which we are able to solve our malicious
content to all the users who access the specific repository.
So, for instance, what I'm going to do over here is after a search, this query, I'm going to take
this first repository, which is Emmis Catalogue, dot S3, Amazon, A.W. s dot com slash index, dot
HDMI.
All right.
So let's copy and paste this over here.
And when I paste this, you can see an error message which says no such bucket.
Now, if you try to recall.
Then we have seen the similar type of example in the Facebook broken link hijacking command indication
video.
So here we have the similar scenario in which it is pointing to one of the AWB bucket, but it is not
created.
All right.
So we are going to create a bucket over there being an attacker.
So now let's quickly jump over here and try to open the repository, so let's see what the repository
looks like.
So there are a lot of files which have been successfully created and so much of the stuff and all of
these files are pointing to Ms.
Hyphen catalog DOT, Amazon AWG.
Now, we know over here that Amus hyphen catalog is the bucket name.
So let's quickly create a bucket name with the same name, which is Emmis Hyphen catalog.
So yeah, let us see if it is allowing us to create a name in the region.
You can choose any region that you want.
So I'm just giving it to default.
Remember, A.W. Blue Bucket are independent of region.
You can choose any region and the buckets will be successfully created.
All right.
So let's turn the block all public access because I want everyone to access the bucket list for the
proof of concept.
Then later on, I'm going to let the bucket.
All right.
So here you can see we have successfully created a bucket and now it's time to upload something into
the bucket to show a proof of concept.
All right.
So let's quickly upload a file into the bucket.
And, yeah, I can notice a lot of UI has been changed on the W.S. console since I have visited this
last.
So it looks pretty clean and nice this time.
All right.
So you can see we have uploaded a file which is spacy dot to successfully it has uploaded.
So.
All right.
So I'm going to upload one more fight with this course because erotics in case we need that or just
leave one file, which is buzy, not the 60 or so just hit on upload and it will be successfully uploaded
by says you must check box that it doesn't want to have Buckett versioning.
And so we do not want to enable any.
So it was it is only Creation's and it is an HTML version if any requests are being sent to your bucket.
So we do not want to do that.
And you can see my file is successfully into the bucket and again, see the bucket you are, which is
given over here.
This is exactly the same that we got into our previous Facebook video.
All right.
So you can see the object.
You are Ms.
Hyphen catalog dot s3 dot eppy hyphen s hyphen Weingard, Amazon dot com slash U.S. dot.
Let's try to open it and you can see we opened it but we got an error and it is access denied access
denied messages due to we have not allowed the public access.
So once we give the public access, now we are able to successfully open it.
Now let's see if the changes reflect over here or not.
So it again says access denied.
First, the message was no such pocket.
And now you can see the message has changed to access denied over here.
All right.
Which means the bucket has been successfully claimed by us guys and we have posted the content into
it.
And the file which is posted or not indexed, not HDMI.
That's why it is giving added, which is access denied because there is no such file like indexed card
XHTML.
There is only one file which is not the.
So now what we are going to do is we are going to rename the file, which is Pewsey to index dot HDMI.
So let me just skip this part of the video.
So I'm changing the bucket settings to public, and you have to conform for that already, it's already
confirmed.
And now I'm going to rename the file of Butyrate 62 in next hour.
So you need to select that file going actions, choose rename first time making it public.
So it is accessible by everyone and now it is accessible, right?
So you can see in next door, which is not accessible, but because it is accessible, because it is
the file which is there onto the bucket, but there is no such Filkin next door estimate, so let's
quickly create an index file as well.
So let's quickly rename this.
So go to actions and click on rhenium object and give the final game of butyrate to index dot HDMI and
hit Save Genius.
All right, so now let's hope we are able to successfully claim this link.
So let's go to this link and let's see the malicious content and it looks perfectly fine.
So, yes, guys, I hope you guys understood how you can take over these bucket names and these links
where they are being pointed but never claimed.
And this was the successful exploitation of broken link hijacking of the entire repository.
So I hope you guys understood.
Thank you.