Hello, everyone, and welcome to this video.
So in this video, we're going to see how can you automate your Estacada finding on vulnerable versions
of Jiddah software, which is running on any target domains or subdomains of any big-Boned program,
whether it is on Backroad, Hagaman, Integrity, etc. Even if it is a private program, you can use
this technique to identify vulnerable versions of Jiddah software, which is running, and you can successfully
exploit them.
All right.
So first you're going to use a Google doc, which is your Dashboard Dart GSP.
And when you use this dark, you are able to identify only and only those domains are subdomains which
have the data version running on them.
So this way, basically, you're filtering out domains and subdomains quickly.
Now, you can see I have got a few domains and subdomains over here, so guys, this is one of the techniques
to identify this another way.
What you can do is identify all the targeted subdomains for your favorite programs and filter from those
any of the subdomains.
If it is running on how to do that, you can simply look at the URL, which may be something like JIRA
Dot or books dot, as you can see over here.
Most of the walls of the software are running on with the subdomains, bugs, dot gardot or tracking
dot.
So you can easily identify and by forget.
Sorry for this and let me just.
Yeah.
Now, as you can see over here, most of the subdomains are running Jira dot.
So this way we can identify them.
Bergonzi, this is Apache.
So I'm just going to copy this and I'm going to paste it into a file for your reference right now.
And we are going to exploit them one by one.
So, all right.
Let's go back to our terminal.
And now I'm going to create a file, which is a list dot dot.
So let's open this list dot the 60 and I have already written.
The targeted subdomains, which are running Gedo, as you can see over here, so I'm just going to copy
this as well and I'm going to pasted over here.
So I have done this manually.
You can also pick subdomains from any tools output like.
So find a fine domain or sublist and you can use that as well.
All right, so let's just copy this as well.
Pasted over here and we are going to identify if any of them are vulnerable to the help of the Python
tool.
Perfect, so we have written quite the names over here.
Let's copy the opera as well and pasted over here.
Perfect.
So let's save it.
Now, we have listed and saved all our targets into a file which is known as List DOT.
Now we have to run Jita standard by which is the Python script, which will help us to identify if our
target is a vulnerable or not, to just hit, enter and wait.
And you can see it as identified that direct or indirect design dot com is vulnerable.
And yes, we know that it is vulnerable, which means the script is running perfectly fine, though
the targets are not one, as you can see or hear.
Perfect.
So these targets are not vulnerable, but you can pass a list of subdomains with all the Jidda related
targeted domains and if they are vulnerable, you will be able to see it over there.
All right, so now how can you install this tool so far that you just need to go to get out of this
security researcher, which is random Ruby, and willing to give the link into the description?
So you just have to get clone into your terminal.
So I'm just going to perform, get clone and hit, enter and can see it as download it, just go inside
it.
And here you can find just cannot buy what.
There is no list dot.
So you have to create your list, the 60 and you can input your bug monitor gets into it and start scanning
them before doing that.
You also have to install the requirements of the file so you can just type pseudo pip install hyphen
R, which means read the file, which is requirements 30 60 and it will automatically install all the
dependencies required to run the school.
As I have already installed all the dependencies, it says all dependencies and requirements are satisfied.
Perfect.
So now you can simply run this and it is going to give error, which will say no file found, which
is list dot.
As I have already said, you have to put all your targets into the file which is listed and then you
can run it.
So let me just run it again, go back and there is list or text.
So now it has started identifying the target subdomains from this file.
So I hope you guys understood.
Thank you.