Hey everybody and welcome to last video of this module on the red team blueprint.
We're going to be going over something called faulty redirects.
Now this is a simple but yet pretty powerful vulnerability for a red team or anybody to take advantage
of.
So what happens here is sometimes when a web app is working it uses its own internal redirect so it
will use a custom PSP file a custom script whatever the case is for the application to redirect a user.
So if the user goes to some page they shouldn't be.
Might do.
For example here it might go and redirect equal to whatever page.
Right.
So when that happens there should be some accountability for the application to know that whether the
application actually did that or the user did that.
So for example the referral link is not a good way or the referral header isn't a good way to do it
but that's one way.
But a lot of this should be internal.
It should be only usable internal to the application.
But in some cases it's not such as for example on this application we've got a welcome page.
We've got our index page it doesn't really give us much.
However we do and redirect.
There is a redirect option.
So if we do do it CTP 0 9 2 to 1 6 8 1 20 to do slash DWI.
So if we did this because this index IPH HP has a redirect method that is vulnerable to faulty redirect
we should end up back on this DV W.A. page.
Right.
So forgotten try that
character and boom we can see we've we're now on the DV W.A. page so we can We can also do this as well
to let's say yes will dot com boom now redirecting to Google.
So the way this works is you can give this exact you URL to somebody else.
But the reason this is important is for phishing or trying to get a user to click on a link because
this domain lets say 1 9 2 1 6 8 1 dot 24 is a domain people trust.
Let's say this is Google dot com Facebook whatever.
Right so if this is Facebook dot com and they see indexed at BHP.
Most users are going to read the domain name in maybe the file name when they look at a link.
That's it.
And when they go there they're not going to see this and redirect which we can encode.
So they can't actually read what's actually happening.
So in this case we can give a user a link to Facebook or Google and they're more apt to click on something
with Google dot com on it rather than malware dot com or some random IP address.
So it can be used it's normally used in conjunction with phishing or something along those lines.
But I just want to make you make you aware of this vulnerability that it does occur and it will sometimes
it might be the difference between gaining access on an engagement or not.
It's very simple.
It's very simple but yet it has some powerful uses.
So this is going to be that this is going to wrap up this module the red team blueprint.
It's going good so far for you guys I hope there's a lot to learn.
Like I said this course is not an all inclusive to two to red teaming.
There's so much more stuff that everybody has to learn in their stuff new stuff coming out every day.
But we've gotten done with the exploitation phase the next phase we're going to be looking at his post
exploitation which is we're in in my perspective a lot of the fun comes in.
You have a lot more options when you start getting access to a machine when you're once you're inside
of a network itself.