Hello and welcome, everyone.
So in this video, we are going to discuss about filters, so how can you utilize filters for identification
of SRF and exfiltration of sensitive data to increase the severity and criticality of your book?
So here we are going to do it onto a life target and I'm going to show you how you can successfully
perform SRF and also use the different types of filters.
All right.
So our target is this Web site and we are going to attack on this.
So what I'm going to do, first of all, is I'm going to scan this Web site using my birth, which is
basically I'm going to spider all the Web users and end points first.
So I have configured this with Bob already.
And now let me just go to my books, Sude.
Do intercept on and let me just reload the Stargate.
Let me just go back to Bob and you can see we have our target.
Let me just send this to reporter and now we want to spider this and get all the possible EQR.
Let me just go back to repeater.
Right.
Click And now we want to spider this.
So let's just click on Add to Sitemap.
And this is now added to site map.
So here you can see of the website is successfully added and our target was ViiV lab, 12. F.R..
And it is all here now, so let me just right click over here.
And click on Add to score, and it successfully added to my school, as you can see over here.
Perfect.
Now let me just click on Filter and click on show only in scope items.
And here you can see I will only be able to see those items which are into my school and all other targets
or background requests that are going into my browser will not get captured into Boxwood.
Perfect.
So now you can read for this and it will automatically spider more and give you some of the links,
as you can see over here.
So we have successfully got a lot of links from here, so I'm going to use one of them.
So let's say I'm going to use this one, which I have already saved it over here.
And you can see this is here.
So let me just copy this.
This is the same endpoint that I have discovered through spidering.
Let me just pasted over here, go to Bob and I'm going to capture this.
Now, I will just go here and I click and send this to repeater.
Now you can see over here, this is the end point, which is pointing to WP content plugins.
They're small to what press?
The smaller BHP is formed through Callicles to get raw data from database query equal to.
Nothing query equals to I have added your target here.
So there was a barometer, I was just replaced that parameter to target here.
Now I have identified the endpoint to be vulnerable.
So what I'm going to do is I'm going to add my collaborative IP over here.
Now, for some reasons, if you do not have a collaborator into the community edition of Boxwood, do
not need to worry about that in this video.
I'm not going to use the collaborative IP or the collaborative client to capture the request and prove
necessary.
Instead, I will show you some of the free resources that you can utilize, which works in the same
an efficient manner.
So first of all, you need to come onto the Web site.
Once you are here, you are able to create a free Web hope.
Now, I have created my free web hook and let me just show you how does it looks like and you will see
your unique.
You are and it looks something like this.
So this is my unique you model and you just need to copy this.
And if we get any hit on our unique curan, it would look something like this.
We can see I have got one request.
This is the previous request that I have got.
Let me just delete this request right now.
And now it is waiting for your first request.
Let let me copy the unique you are to my Vanderhook.
Go to Boxwood and enter my Rampal quarrel and hit send.
And you can see as soon as we hit send and we have received a response, there comes a hit on to our
web who you are, which means the host from which we are getting the hit is wonderful.
You can see we have also got the host IP.
If I do a whois, I would be able to know that this request is coming from this particular target.
All right.
So let me just close this and show you the second alternative.
So this is the second alternative, which is Pipedream dot com.
And you can just come over here and you can request a bin and you can see waiting for an event.
So it is waiting for even to happen.
Now, this is your end point, which you can utilize.
So let me just copy, even go back to Boxwood and replace the previous one with the new.
End point of our question and let me hit send.
Let's wait.
If we get a hit over here, as you can see, it says success through.
Let's wait.
If we go if we have got a new request, once we get a new request, it is going to send a ping over
here.
And you can see we have got a successful request over here.
And you can see it comes from the same IP address as we saw previously.
Perfect.
Now, we have come to know that our target is one rebel.
That is the reason it is making connection request to the attacker, control domain or any third party
domain.
Similarly, this is a third resource that I am going to show you, which is a request catcher dot com.
Not the best thing about request catcher dot com is you can also create your free subdomains, as you
can see here.
So I have created a free subdomain which is backboned or request catcher dot com.
And you can see your I can receive successful requests, know how to use this.
Once you have created your subdomain, copy the sub domain name.
Go over where you want to test for Estacada.
Let me just replace this with my new subdomain of request.
Gachet And let me just right here.
SRF So the subdomain and the endpoint, I can add anything that I want.
I have already done this test once, as you can see, and the endpoint that I chose was slash test and
this time I'm choosing SRF so that I can show you I get a new request onto my body, not request catcher
dot com.
Let me just hit send indigency.
I have successfully got one more hit and this is the hit which I'm getting from the same target, which
is this IP address.
Now this proof that I was able to successfully induce a request from this target to myself.
Now in the next video you're going to see how can we utilize this to exfiltrate sensitive information
from the target.
Thank you.