Hello, everyone, and welcome to this video.
So in this video, we are going to see Estacada based attacks and to start with, we're going to see
suicide attacks against the server itself.
So as we already know, using SRF, we can scan any third party based Web application through the vulnerable
server.
Now let us see, how can you utilize SRF to scan the server itself and how you can exfiltrate sensitive
data or information from the server.
So many times the admin functionality is only accessible to the authenticated users of the target program
or the application.
So when any attacker could impersonate and makes a request through the local machine, he gets access
to that functionality.
What does this actually means?
This actually means that the attacker is going to fool the application and make the application thing
like the request is coming from the organization itself.
And the application will allow the admin functionality to all its local users.
To understand this, we are going to see a simple animation and get the principle.
So onto the left hand side, you can see there is an attacker who is going to send the request to the
vulnerable Web application on your right hand side.
And the request is going to be let's get admin the hostess example, dot com as it is our vulnerable
application example, dot com.
And let's suppose there is a parameter you are called to into the body, which is again, example dot
com, which is the name of the web application.
The server is going to send a response to the attacker and the response is going to be for not three,
because the attacker is not allowed to see the admin functionality of the vulnerable Web application,
which is example, dot com.
But if the attackers and again, I get request to slash admin with the same host example dot com, but
this time in the U.
All he impersonates himself as the request is coming from the localhost.
As you can see, this is a Lubeck IP.
The server quickly responds with two hundred, OK, thinking that the request is coming from the internal
of the organization and gives the admin dashboard all the functionality.
So what is the impact of this?
The attacker is able to access the internal portal or any and which he or she is not allowed to, so
SRF gives you the functionalities which are hidden from the public world and you can exist inside the
organization.
Attacker is also able to bypass the access, controls and authentications to access to protected resources.
That we have already seen attacker can also perform sensitive actions under the targeted Web applications,
like deleting account or modifying some data which are going to see in the practical in just a couple
of few seconds.
Also, the attacker is able to execute commands to scan the internal report and also the network to
identify if any one of the services are been running and further exploit them.
So what are the steps to perform this SRF onto a target web application?
So I have listed down four steps to solve this practical or to perform this attack.
The first one is.
We will exploit a Web application to induce a request to the backend server by bypassing the access
control.
So basically what we are going to do is they're going to send request to the localhost or through the
Lubeck IP address to the Web application and print the Web application in thinking like the request
is coming from the internal organization.
Then we are going to perform some sensitive actions as unauthenticated users, which the application
is believing us to be authenticated user.
Hence our attack will be successful.
So it is a practical line.
And let's quickly jump onto the practical to understand how can we do this as a side of attack.
So as you can see over here, I'm onto the ports with our Web Security Academy Lab, which is basic
as orif against local server.
So we are going to solve this lab based on the information that we have learned a lot.
OK, so the question is to solve the of genes, the stock check, you are able to access the admin interface
at localhost, slash admin and delete the user cardless.
So we have this task to be performed.
From this information, we understand this, that there is a Web application which gives us some stock
information about the target and we need to delete a user by being an admin user.
So first of all, we are going to configure Bob so quickly with our Web application, as you can see,
and I'm going to intercept a request.
So we are going to perform the attack from our books.
Now, let me just increase the display size, the font so you could see it more better.
Perfect.
Now, over here, you can see I have got the request in my data and you can see it is working perfectly
fine.
So now it is the time to get the request off the stock.
So let's come on to the space.
And at the bottom, you can see tech stock.
So I'm going to just click on that and I'm going to capture the request in Bob Suit on which we are
going to perform this SRF based attacks.
So as you can see, I have captured the request over here and now I'm going to send this to repeater,
as you can see now, this request is in the repeater.
And you can see we have got that there are 121 units in installed in London.
All right.
Let's get back to Bob and hit send.
And you can see we are getting a response of the stock now.
Let's go back to the question and see if we are able to see the stock check feature.
Yes, we are absolutely able to replicate that.
Not just all the love change, the stock check.
You are able to access the admin interface at localhost slash edman.
Perfect.
So now we are going to send a request to localhost.
So for that we will simply type htp cool and slash localhost and hit send.
And let's see if it is able to communicate to localhost or not.
And in this way able to see the output perfect.
And you can see we are also able to see the admin panel as well, which we were not able to see previously.
Now remember, if I put any other you are over here, it is going to behave in a different manner.
So let's say I put something which does not exist.
Let's say localhost does not exist, dot com.
Then it is going to throw error into the response, which means it is not able to successfully load
the resource that we are trying it to fetch.
Perfect.
So let's click on Render and let's see if we are able to render this.
And you can see I have got a successful admin panel functionality which was not present before, as
you can see over here to conform.
Perfect.
So we are in the right direction that we are able to get the admin functionality because the Web application
now thinks that the request is coming from the internal organization or the localhost.
Now, the second part of the question is we need to delete the user, which is Scarless.
All right.
So let's see if we have any information about Carlos.
No, because we are not still on to the slash admin.
You are.
So now you can see if I had this and find we are going to get some information and you can see delete
Carlos and delete Vinyard, as you can see over here.
Perfect.
So we have got more sensitive information from the targeted application in which when we hit the admin
dashboard, we get the list of all the users from the application.
The first user is admin, Carlos and Vinyard.
Perfect.
Now we want to delete one of the user.
So what?
We can do it.
We can delete it from our boxwood as well as well as we can delete it from our browser as well.
Let me just copy paste this over here and here, you can see I can just simply hit on delete and it
says admin interface only available if logged in as admin or if requested from lookback.
OK, so it basically means that your request should be coming from admin portal only.
All right.
So let's hit the request from Boxwood to delete the user.
So let me just copy this.
And pasted over here for this basically means that we want to delete a user, which is Karolos and you
can see three or two phone perfect.
So we have successfully solved the lab.
So what are the key takeaways from this?
The first is that we took a vulnerable endpoint that was stuck and we ended up entering the localhost
to see if it successfully lowered.
If you put something which does not exist dot com, then it is going to throw error through which we
can confirm that it is interacting with the target that we are giving.
In this case, we wanted to interact it with its own server.
That's why you are given the localhost.
Also have given the port, for example, localhost Colen 22 to do a potkin as well.
But that was not required in this case.
So later on we identified when we give localhost we are able to get admin functionality and then we
are able to see three users when we hit the endpoint, which is localhost slash.
And then we deleted one of the user and we successfully solved the lab in which we are able to perform
an admin feature on admin action, which was an authenticated user.
So I hope you guys understood how to perform this and how you can do this attack.
Thank you.