All right, so we have opened our terminal, so in the terminal now, we are going to enumerate the
subdomains of our target.
For that, we are going to use the tool, which is a fine domain, to find the main hyphen, hyphen
D, which stands for Domain Name.
And I'm going to copy the domain name from here and I'm going to paste it over here, which is intellect,
design, dot com and I'm going to hit enter.
All right.
So it is hyphen P, which stands for Target Hyphen D.
We use this flag in sub finder, which is another tool, which is again a very good tool, which is
used for identification of subdomains.
You can use either of the tool.
Both works pretty fast and fine.
So now it has started enumerating the subdomains of the target and it was very quick to identify subdomains.
And you can see we have a total of 76 subdomains in just three seconds.
Perfect.
So out of these subdomains, we are going to choose one of the subdomain, which is JIRA, dot intellect,
design, dot com.
Now, why specifically JIRA?
Because guys that SRF that we are going to find is only working on a vulnerable instance of Jidda,
which means any domain.
The subdomains right now, anywhere in the world which are running on the one level version or the software
of Jita can easily be exploited through this practical.
All right.
So let's just copy this.
So go to our browser and paste it over here.
And now let's wait for this to open.
Once it gets open, we are going to see if this target is vulnerable or not.
All right, so it has successfully opened the way here, as you can see, Girot in leg design, dot
com slash dashboard dot GSB perfect.
So now we have our target for application running over here.
Now, this is the end point that we need to hit to identify the vulnerable version of Jita and we will
perform SRF over there.
So less so let's just based our end point over here and you can see the consumer.
You are a barometer.
Is the inflection point into this one level version of software?
Yeah, we are going to paste Google dot com.
So basically we are issuing some of the request to a third party domain from Girot or intellect design
dot com and let's see if it works or not.
And you can see it has successfully loaded Google dot com over here.
Perfect.
Now, this proves that this target is vulnerable to SRF.
Now to change it with Exercice, what we are going to do is you need to come to a secure dot x, y,
z, slash Estacada legitimate.
So you're I have blusterer exercise payload, so I'm going to be a lawyer and I'm going to load it.
So I'm making a request to my attacker control domain.
And you can see geraud intellect, design, dot com is vulnerable.
We have got exercise a lot over here and when we hit OK, we will also get the cookie over here, as
you can see.
So this way the attacker can get hold of the cookies of the user if he or she is logged in.
So now this way we have escalated our SRF to exercise as well to steal the cookies.
Now let me go to the pizzas and show you your very simply little document or domain.
Plus, the domain is vulnerable and we are alerting document that cookie.
Of course, this payload can be modified in which the cookie should be sent to the attackers control
domain.
Now this is enough to prove the SRF and Exercice, so I hope you guys understood this.
If you have any doubts or questions, you can post it into the.
Thank you.