Hello, everyone, and welcome to this video.
So in this video, we are going to perform SRF attack with GIRARDEAU means also we are going to see
how can we escalate it and also combine it with exercice attacks.
All right.
So let's quickly start.
So we are going to induce a SRF in the venerable version of JIRA in the venerable barometer's and willing
to exploit it, and what is the wonderful barometer?
It is consumer you are.
So we are going to use this and perform SRF and also we will look how can we perform Exercice with that?
Now, to understand this year is a very, very simple principle with the help of animation.
So let's understand this.
So here is the first attacker.
Second is the wonderful application, which is example dot com.
And third is the attacker controlled domain, which is attacker dot com.
So first, the attacker is going to send the request to example dot com, which is a get request.
The host is example.
And the consumer, you are a vulnerable parameter, says Google dot com.
So the target applications and the response to the attacker and it successfully redirects to Google
dot com.
So we have seen that we are able to induce a third party request from example, dot com to Google dot
com.
Now, in order to achieve exercice, we are going to send a request to attack a dot com slash Estacada
dot html and which contains the successful payload of exercice.
And when it gets the response back to the example dot com, it successfully executes the exercice.
So through this technique, the attacker can also perform exercises and steal cookies of other users.
Moving ahead, it is a practical time and let's quickly see how can we do this practical and understand
this?