Hello, everyone, and welcome to this video.
So in this video, we are going to see the steps and approach towards identification of SRF based on
the abilities.
So the first step is that we will exploit a Web application to induce the request to the attackers controlled
server.
All right.
This is what we have understood into the principal as well.
Moving ahead to the next step, we are going to configure the collaborator as a third party surfer in
case you have any of your VPs or any of your website, you can use that as well.
I assume that many of you would have your own Web application or your own VPs, which can be used as
a third party server in case you do not have it.
No need to worry.
We are going to use the collaborative.
In case you also do not have collaborated, then I'm going to tell you a very, very simple trick and
a very good resource that you can utilize as your third party attacker controlled server.
So the third step is wait for the interaction from the target of application to identify if it is vulnerable
or not.
Once have identified it to be vulnerable as we get a successful interaction, then we will do the attack
on that Web application and complete the successful attack.
So let's quickly jump on to the practical aim to successfully do a SRF attack on a target application.
So for this example, we are going to take a test, BHP in Web.com as our target application to identify
SRF based vulnerabilities.
So the first thing that I'm going to do is I need an injection point to identify.
For that, I'm going to use Bob's in the Bob suit.
First, I'm going to spider the application to identify entry points and increase the scope of my target
of application as I'm running on Version 2.0 in which the spider has changed its name.
So I'm going to show you what is the change name of Bob Spider into the version 2.0 X.
So let's quickly go back to the application loaded so we get a request over here.
Now, I'm just going to right click first.
Send this to repeated again.
I'm going to right click and I'm going to click on Engagement Tools and I'm going to click on Discover
Content.
Remember, Bob Spider has changed its name to content, discovery or discover content in all the versions
of Bob Suit with starts from 2.0.
So we just need to click on Section is not running and it will start your session and it will start
identifying or scrolling the target application for a lot of you are and parameters.
As you can see over here, you can simply go to site map and also see the target audience that are loading
here now as we want a few of the audience which contains the parameters.
So I'm just going to double click on patterns and you can see we have successfully got all the parameters
over here.
Perfect.
So I'm going to pick one off the parameter from here.
So let me just minimize this, because I do not want to stop spidering.
I want a lot more request because, you know, the more you spider, the more assets or scope increased
you get, which means that you are increasing your chances of getting a valid venerability.
Now, for instance, for now, I'm going to close this because we have already identified a lot of you
are right now.
And I'm going to choose anyone from this into a real time scenario, onto a bug bounty program that
in your hunting on a Web application, you can keep it running so you get more number of requests.
Alright, so let me just exit this.
Now you have to go to your target and from here let's pick any of the target.
You are it.
So let's say we are going to pick one of the URL, which is for example, let's pick a u r l which starts
or it is file equals two.
So let me see if I can see you are like this.
Let me just right.
Click over here and click on add to scope.
I can filter this based on scope as well as I do not want to see any clutter over here.
Again, again.
Right click.
I can go to engagement tools, I can again click on discover content and start and it will start identifying
and crawling the target again.
OK, now if I want to identify a specific set of parameters from the given discovered content, I can
also do that.
For that you just need to go to Bob and you to search.
So now I'm going to search for something or less file.
Now you can just take this option as well in which you have to choose in scope only, which will only
search the parameter file into your in scope domains as well.
So I'm just going to go and you can see I have got a lot of your URLs, which contains a file already.
So I'm going to choose one of which is this.
So let me just.
Right.
Click and send this to repeater.
Perfect.
Now we have one of the U.
All which I'm going to try for a successful SRF.
So let me first let go and see what is this which it contains.
So I think it contains a picture, which is why not let us render and you can see it contains a picture.
All right.
So now we are going to test the parameter file equal to if it is vulnerable to SRF or not.
So, as I already mentioned, that we are going to use Bob collaborator's, so you for that, you just
simply need to click on Bob and you can choose the Bob collaborator client.
Now, you can see over here, this is number to generate, which means how many collaborative payloads
we want to generate.
So I just want to generate one.
You can also choose one and click on copy to ClipArt and it will copy the collaborator client payload,
which is nothing but your third party source name.
Or the address poll, every 60 seconds, you can choose or you can make it to one second, which means
it is going to refresh and check if there are any interaction requests that have come or not.
So let's click on Copy to Clipboard and go back over here.
Now, let's just remove this and we start over here now as we want the request to be sent.
So let me just add HDB in front of it to make the request go to our collaborative server, which is
our third party server, and make the application.
It is HDB based server.
All right, so now let me just let go and let's see if we get something in the response and you can
see I got a 200 and something in response, go back to your collaborator and see if we have got something.
And you can see, yes, we have got a couple of requests over here to let let's see the request that
we have received over here.
And you can see this is the request which has been received.
The collaborators are had received and HDB request.
The request was received from the IP address, which is this IP address.
Now, let's verify if this IP address belongs to whom.
For that, let's go back to O'Haire based IP address over here.
And you can see the IP address belongs to accountings, which is test BHB.
Perfect.
So we have identified a valid SRF over here as it is making interaction with attacker control third
party domain.
Let let me show you the collaborator client and let me see where is the collaborative client.
It is over here now.
This is the spider which is running.
So the collaborator client should be.
So I think so I'm just going to start a collaborator client again, I have closed the previous window.
So now again, I'm going to make one over here because you want to pull it in once again or copy this
over here, pasted over here and let's see if we get any traction.
Now, remember, you need to add GDP and pasted over your head.
Go wait for the interaction.
Let's verify if we got the interaction over here.
And again, see, we have got a successful interaction from the IP address, which is belonging to a
target.
As you can see over here.
This is the response that we have got from our target.
So this is how you test for SRF based one liabilities on onto any target of application.
So we will end for this video into the next video I'm going to show you if you do not have Bupp collaborator.
But is this option for a third party services or third party attacker control domain, how you can utilize
any of the free and useful resource?
So I hope you guys understood.
Thank you.