OK, so now, as we have identified the target to be vulnerable to SRF potentially as it is making a
request to the third party controlled domain, now we are going to escalate it.
So what you can do basically is try to scan the internal network as well, identify both whatever services
are running on different ports.
But we're not going to do the usual thing over here.
Instead, we are going to use different filters to identify more sensitive information and dump sensitive
information.
So I know the application runs on WordPress because when I was spidering the application, I have got
this directly, which is the content which proves the target is running on a WordPress.
Now, for those of you who know that whenever you make an application on WordPress, you have a login,
which is the WP admin login, and there is a configuration file, which is WPE config, which is a WordPress
configuration file.
So what we are going to do into this video is we are going to retrieve the WP configuration file for
this target, which contains extremely sensitive information like the database name, the secret keys,
password or details, etc..
Now, in order to do that, we are not able to retrieve files by just giving the name of the file.
So let me just show you let me go to my board again and now.
Let me just copy the final from here.
OK, so now I want this file, which is what press configuration, not BHP.
Let me just hit send and you can say it is unrecognized call.
So smouldered BHP, which is this end point, does not understand what exactly is WPE config.
Let us try to navigate inside some directories and now let's see if you are able to get it.
And still we are not able to retrieve the file now.
Folders come handy in place and we are going to use that.
So let's say I'm going to use the BHP filter this time and I'm going to try to get the file.
And you can see it still gives me the same error.
All right, so now I'm just going to use the exact same payload to identify the website is vulnerable.
So now we are going to use the BHP filter and the resource file or the resource data that we want from
the target server, which is the bloody conflict at BHP.
Let me just hit send and you can see we are successfully able to get the WordPress configuration file
and you can see the DBI name is White Lab one to white lab one to the password.
So they have not kept any DB password, which can be only retrieved or connected from the localhost.
And you can see a lot of more sensitive information like authorisation, key sigatoka logged in, key
nonskid, logged in salt, etc..
So now this is very sensitive information and can be reported to the target bug bounty program, which
will be flagged as a critical security vulnerability.
Now, as we can see over here, we have used a couple of dot slash just to navigate from the directories.
And if I do not use this, we will not be able to retrieve the result.
This is because we are going one step, two step three steps and into the full step back to navigate
into the directory where this file lays, which is WP config, not BHP.
And in a similar manner, you can download any sensitive files from the target.
If you want to see what other files can be downloaded from a WordPress configuration, you can just
go and have a look at the official WordPress documentation, but then you can see what are the other
files which contains sensitive and juicy information.
I have shown you the WP config that BHP, which is the most critical file as we have seen it, contains
the information about the database as well as the art keys.
So I hope you guys understood how we are able to retrieve this using the BHP filter.
Now, just a quick side note that you should remember sometimes instead of BHP filters, you can also
use these filters like File, DECT, SFP, Ghafoor, etc..
Many times these filters are also helpful in retrieving sensitive information from the target of a war.
So you should always give a try with these filters as well whenever you have identified necessary to
retrieve sensitive information from the target from application.
I hope you guys understood.
Thank you.