Hello, everyone, and welcome to this video.
So in this video, we're going to discuss about Estacada attacks with the help of MBG.
So what is it actually so we can also perform SRF attacks using a specific format for video files.
So how are we going to do this so we can induce a society using the MPEG video payload embedded inside
of it?
Many times application doesn't validate sensitive input or even special characters.
So we will use this and perform of on the line of application and exfiltrate some of the sensitive information
from that website.
I don't understand this, let's quickly jump into this principle, so you're I'm going to explain you
with the help of animation.
So on the left hand side is the attacker machine.
On the right hand side, there's the wonderful Web application, which is example, dot com.
So the attacker is going to send a request, which is a post request.
Let's say the request is to convert the video file from one format to the format.
As you can see, the request is a post request to an endpoint, which is candidate PSP, the host example,
dot com.
And the content is, for instance, we have put ADC slash past W.T. When this request goes to the application,
the Web application in turn send the response to the attack ad in which it says two hundred, okay.
And attacker is able to successfully get the sensitive content of past W.T. from the vulnerable application
server.
But what is the impact of this?
The attacker is able to bypass the access control and authentication mechanism to get access to the
protected resources.
In this animation, we have understood how the attacker is able to get hold of the past W.T. file.
But if he knows the internal structure, he can also get access to any other sensitive file as well.
The attacker can similarly perform sensitive actions onto the target web application, and he or she
may also be able to execute commands to scan the internal borders and the network.
Now, what are the steps we are going to perform to achieve this as SRF?
So we will exploit a Web app to induce a request to the server and retrieve sensitive information.
In this video, we are going to perform a sensitive action as an unauthenticated user and we are going
to download sensitive files from the machine.
For instance, EDC possibly fail and if our attack is successful, then we will have SRF on impact on
one of the application.
So it is a practical time and let really jump on to the practical to see to see how are we going to
perform this?
Yes, so first you need to come to this GitHub repository, and after you are to this GitHub repository,
we have to download this so you can choose an option to download or also you can perform a clone.
So I'm going to get clone into my terminal.
So I'm just going to try and get clone and the link that we have copied.
So it gives the error, which is already exist and is not empty directly, which means I already have
this downloaded into my computer now for you, I'm going to delete it and I'm going to read downloaded.
So let me just perform Orham hyphen Ariff to remove it forcefully.
And now it has been gone from my computer.
Now I'm just going to get down again to download it.
As you can see, the download has successfully completed.
Let me just go inside the directory and you can see your is the file which is Generate Expen Avodart
by which is a Python script.
So I'm going to just run it.
And the format to generate your payload is give Philco lendable, slash, slash, ADC positive ludi,
which is the file that we need to download from the target server.
Let's give the name of the output file that we want to get generated and let's say we give the name
as it is out of Todavía.
For instance, you can give any name that you want.
Just remember to give the extension.
As Evy, I know you can see the file has been successfully generated.
Now we are going to use this file to upload onto target of our application so you can see this is alive
website, which is files hyphen conversion dot com.
And you're this website convert the video file into other file formats.
So we have generated our malicious file in the format, which is evea, and we are going to generate
it to a format which is DOT.
And before you can select a file option is there.
So I'm just going to click on that and it is going to ask me that which file you want to upload.
Let's quickly give the directory part of the file.
As you can see, the file that we generated was Estacada after EVA and hit Dunwood.
Now Button, as you can see, it has been processing.
So what is happening in the background is the file has been successfully uploaded, which contains our
payload, which is slash ADC slash possibility.
The back end engine is rendering that filename and the part from the file and it is going to give us
the file data into the new render or converted file.
As you can see, the result file is as a sort of dot com before which are successfully generated.
But on Firefox it says video can be played.
Let's go onto Chrome and see.
And when I pasted over here, we can successfully see the file is rendering and it is going to play
and perfect.
We are able to see the content of ABC past W.T. file into our newly converted output file, which is
of drawn before.
So I hope you guys understood this.
So what has happened into the back end is the file got uploaded which contained the malicious payload,
which is file colon, double slash, slash EDC possibly it got red by the back end engine.
It got rendered and we are able to see the output of that file through the same as of DOT and before
converted output file.
I hope you guys understand this.
If not, you can ask it into the Q&A section and I would love to help you guys.
Thank you so much.