Hello, everyone, and welcome to this video.
So in the previous video we have seen about the micro strategy.
This is a refundability which was identified into the Facebook account.
So we are going to replicate this same vulnerability over here.
So to do that, first of all, what we are going to do is we are going to write down a few steps.
So let me just open up the editor.
So the first step is we are going to identify a micro strategy, Vladik, on any subduing.
So first we're going to identify a subdomain and we are going to see if it redirects to MicroStrategy,
a Web portal, as we saw into the Facebook, and it was giving error.
So we are going to expect that once we have identified the target domain, which is running on MicroStrategy,
we are going to input Google dot com to see if the you are it is valid or not.
And then from there we can confirm if the URL is working or not.
So as in the U.S., we saw that you all would not work because into the software configuration dimmy
you worry is something which will only work.
So we are going to try with tiny you all and we are going to see if it correctly loads or not.
And then we are going to load our tiny you are based exercice
page or the exercise payload over here to make this one from SRF to exercise to increase the impact
and overall security of the vulnerability.
We can also make the same flow page of the target of application as we saw into the Facebook scenario,
and then we can fish credentials of any legitimate user.
All right.
So let's quickly jump onto the practical and let's see these steps one by one.
All right, so here, as you can see, this is one of the subcommunities reporting.
Dr. Baron, LTG dot com.
So when I just go onto that subdomain, it automatically redirects me over here, which means the first
step has successfully satisfied it redirects to MicroStrategy.
All right.
So this is a wonderful target.
Now, let's quickly copy the injection point that we saw.
Which was the targeted you are endpoint.
So let's just copy this, go into the browser and try to open.
So you're you have to notice that we are trying to open Google dot com and as expected, we have got
an error that Google dot com is not a see if you are or it would not work here as we knew.
It is not going to work because it is written into the software configuration.
So let's try with Tiny.
You are dot com and let's see if it works or not.
And you can see we are successfully able to open tiny you are inside reporting dot badon, ltg dot com,
which is our venerable life domain.
Perfect.
It is working as expected and now we are successfully able to load the time neural domain to.
Now let's just quickly navigate to assassinate your daughter X, Y, Z of Yemen where I have posted
an editorial page which contains a exercice payload of executing the document, not Cookie.
So I'm just going to copy that and I'm going to paste it over here.
Now we know it is not going to work because it does not load any.
You are apart from Dinny.
You are.
And so we have to convert that as well.
So you saw we got an error which was expected.
So now let's quickly open dining you hall and we are going to convert over time.
You know, also, if I show you the error into Chrome browser, you can see this is how the error is
displayed into the response, which is the source, you are told is not valid.
And if you remember, we were getting the same error into the previous video, into the Facebook IPO
case.
Perfect.
Now, let's quickly make a tiny order to exploit this to exist.
So let's open tiny.
You are a little dot com.
Go over there and copy the link of singular direct phys ed slash SRF, dot its general and paste it
over here so you can see ended along your order to make Tiny.
So we are going to be straight over here and it is automatically going to shorten over.
You are so just hit on, make tiny order and envied and you can see the you are and has successfully
shortened and converted to a tiny.
You are perfect.
Now let's just copy this, go back to our target and try to load it over there.
Over here.
So if you recall, we are not able to open.
As I said, you ordered x rays.
It is after estimate which contains our excess payload.
But when we replace this with Dinubile, which basically points to our secure payload, we are able
to successfully get the exercise execution.
As you can see here, you can also see the cookie over here because the payload is document, not a
cookie, not attack.
Attacker can utilize this to steal it.
Obviously, to make another scenario, we can also make a similar phishing clone of this target for
application and try to load it over here by shortening the you are with the help of training your.
So I hope you guys understood how we are able to replicate the same PEOC or the same attack of SRF that
was reported to Facebook on the Alive website.
I hope you guys understood.
Thank you.