Hello and welcome, everyone.
So in this video, we are going to see suicide attacks against another banking system.
So in the previous video we saw how can we attack our own system?
But now we are going to see how can we attack any other banking system which is running into the same
network of the organization.
So we are going to scan the target machine, which has the admin interface on the board, and we are
going to use it to perform more sensitive actions.
All right.
So to understand this principle, let's see a quick animation so you can see here is the attacker.
And there is a wonderful Web application, which is example dot com, which is vulnerable to SRF, and
there is one more application into the same network, an organization which is awesome app, dot com.
So the first attacker is going to send a request to example dot com and the request is going to be a
get request of, let's say he wants to access the admin portal on the host example dot com, whether
you are allowed into the body of example dot com.
So it is going to reply with a response which is going to be forbidden.
Now the attacker is going to send one more request that is a get request again to the slash admin portal
on the host example dot com, but into the you are a barometer from the body that specifies awesome
app dot com slash admin.
Where is the actual admin portal hosted?
So this time the vulnerable application example dot com is going to send a request to awesome app dot
com, which is specified into the mean request which has been sent by the attacker and the Web application,
which is awesome.
Dot com in return gives the response to example dot com which it sends back to the attackers browser
or attackers screen.
And this way the attacker is able to get the sensitive information from the Web application, which
is awesome of dot com to the wonderful example dot com machine.
So I hope you guys understood this, no, what is the impact?
The impact is exactly the same that we have seen into the previous video in which the attacker is able
to exploit this SRF into their own system of the Web application.
So what are the steps that we are going to do, so we will exploit our obligation to induce request
to the backend server by bypassing the access control, as we saw into the animation, we're going to
send request to another server and perform sensitive actions after we have performed sensitive actions
as unauthenticated users not being admon, we will confirm that our attack was successful.
So it is the practical time.
And let's quickly jump on to see how can we perform this exercise of attack against another back systems
into the same see over here.
This is the lab that we are going to solve, which is basic SRF against under the banking system.
Now, let me just click on Access Lab and we can start this lab before that.
You can see the question is to solve the lab, use the structure functionality to scan the internal
network, which is 192 dot 168 or zero dot x, which means you do not know the target system as it is
given as X.
So we need to know the target system from the range for the admin interface on which Board 88 is running,
and then we are going to delete the user that is Carlos.
So let's quickly begin with the lab and you can see this is the Web application.
Let me click on you detailed.
And here is the text functionality.
Let me quickly set up Batsuit, and I'm going to intercept this request in my book.
Now for this video, I have used my professional records scanning the range.
I'm going to use intruder just not to make the video much longer.
I'm going to increase the threat in my intruder so it does the process a little bit faster.
You are good to go onto the community in addition as well, because we can do the same thing on community
edition, but just your request are going to be a little bit slow, but it should do the job for you
and it's exactly the same.
You just do not get to tune your request, which means you cannot make them faster into the community
audition.
Other than that, it is exactly the same and works perfectly fine.
All right.
So this is a request that we have got.
So I'm going to send this request to repeat it.
Now, once it is into the repeater tap, we are going to do the inspection of this request.
So you can see this is something that is passing into the parameter, which is stock epper equal to.
So let us first send this to Decoder and see what exactly is this.
And you can see this is the you are Elvis has been passed with these HGP IP address, which is 90 to
168 081 and Port Adelaide product stock check, product ID and ready.
All right.
So now we know that into the question.
There was admin specified.
So we are going to replace this with IP address, which is that 081 colonnaded slash admin and let him
go and see if you are able to access the admin portal.
So this was just a random hit and trial.
And you can see we got an error message on a 400 board request, which is missing parameter, which
means obviously this is not the correct machine or the server.
So we need to identify it, which is the correct machine.
For that, we are going to use intruder and we are going to identify the right IP address from the range.
So we just need to select this one.
Click on ADD because this is our inflection point going payload type and use numbers.
So we are going to choose numbers from zero to 254 to scan these many IP addresses with the step of
one and hit on start attack.
Now, when I will hit on state attack, it will automatically start scanning the IP addresses from the
range that is zero to 250 for.
And we are going to start the results based on the status, as you can see over here.
Let's just wait for this to complete and then we are going to observe our results and identify which
is the correct IP address of the backend server, which is running.
And then we are going to get the admin status or we are going to perform some sensitive actions.
As you can see, this is the error that we get on invalid external stop check.
You are an invalid IP before address when the IP is to 168 00 because that is an invalid IP.
You can see you're missing parameter error because this is the same IP, which is 190 to 168 zero,
not the error message that we have already received.
Now, if you notice, all year we have finally got a status code of 200 onto the payload, which is
two zero six perfect.
So we have identified that the IP address is 190 to 168, zero two zero six.
You can also click on state staff and you will be able to see the 200.
OK, perfect.
It is all here.
Now, this proves that we have identified our target vulnerable system, which is running the admin
interface.
Let's confirm.
But this a repeater head.
Go and see if we are able to see.
And you can see we have the admin portal access and here are the three delete button with administrator
Carlos and.
So we need to delete Carlos to finish this lab and this exercise.
So we are going to delete the Carlos from here.
As you can see, when I rendered we're able to see the list of users as we have successfully logged
in as admin panel and these are the users.
So let's just remove this and delete the user, Carlos.
And he'd go.
Perfect.
So we are able to delete the user and let's see if we are able to complete our lab and congratulations.
Awesome.
So we have successfully sold our.
So I hope you guys understood.
How did we do this?
Let me give a quick recap.
First of all, we identified that the stock parameter is vulnerable because it was given into the hands.
The next thing that we did was we needed to identify the correct server, which is the backend server
or the IP address from the range.
So we did that using intruder.
So we brute force the IP from zero to do 54 and based on the status could be identified at 200.
OK, on one IP.
And we successfully identified that the admin interface or the admin portal was running on that IP address,
and then we successfully deleted the user.
So I hope you guys understood this.
Thank you.