OK, components with known vulnerabilities.
This is a really interesting vulnerability because it's a really, really big one.
We're going to take a look at the example of it in our tri Hackney platform.
So just navigate to your own top 10 and you will have it on task.
Twenty seven, twenty eight and task twenty nine.
So what exactly is this vulnerability?
Well, applications can run on certain software and this can be any software from Tomcat to WordPress
to using to using different types of databases and all of that.
And all of the software is had some type of vulnerabilities in the previous versions of them.
Now, what happens is that many websites and many companies don't regularly update their software.
So a good example here is that it says, let's say that the company hasn't updated their version of
WordPress for a few years.
And using a tool such as VPs, can you find its version four point six?
Some quick research will reveal that WordPress four point six is vulnerable to an unauthenticated remote
code execution exploit.
So many of these software's well-known softwares have known Mobility's for previous applications, and
this winnability occurs once an application is running the software that is outdated and that has unknown
vulnerability.
Now, this is a big topic that doesn't really have anything to do with bug bounty, but we're covering
it nonetheless because this is also something that you want to search for.
So in this example, I have already started my first time machine and you can start it on task number
29.
The task that we have is how many characters are in slash at slash stability file.
We can use this command to determine that.
So let's give it a try.
Let's call the IP address of our machine and copy it straight into the browser.
OK, so it opens this application that's called online C.
S E bookstore.
And since we already know what type of vulnerability this is, we would actually try to scan it for
different technologies that this application runs, what Web server it has, what programming languages
use and all of that.
But particularly we also want to check out the application name.
So, for example, this online bookstore could be something that is used widely and that actually has
some abilities.
How can we determine whether it has no abilities?
Well, we can just copy its name and try to find something on Google.
Now, make sure that you don't confuse this vulnerability with the vulnerability where we covered with
default credentials, default credentials or something else.
That is the mistake of the owner that they didn't really change their default credentials.
It's not a software vulnerability, however, this might have a software vulnerability.
And by the results that it gets, it does indeed have the.
We get two results or even three results right here, but only the first two are on famous exploit website,
which is called Exploit Dash DBE dot com.
On this website, you will have a bunch of different exploits for a bunch of different, outdated versions
of software.
Well, let's go with this first one first.
It's called Online Bookstore Unauthenticated Remote Code Execution.
This is really a serious vulnerability, and how this website works is it gives us the code to the exploit
in this specific example.
The code is written in Python.
Now, we can download the code by clicking on this button.
And what's good for us is that we don't really need to know what exactly this code does, even though
that is something that you want to get used to.
You want to get used to reading code.
And even better would be if you were to learn some programming language, because you will need it sooner
or later once you get into this field of ethical hacking and bug bounty.
Nonetheless, we're not going to refer to this code that much because programming is not a topic for
discourse.
However, we're going to download this code and run it and see what it does.
And that is also another reason why you actually want to learn programming, you don't want to be running
any type of exploits on your machine.
If you don't know what this quote does, then you won't really know what it will do on your machine.
It might do something malicious.
You never know, especially when you're downloading exploits from some sketchy site.
Nonetheless, this exploit database dot com and it should have a working exploit for us.
So let's open folder where we downloaded our python code and it's called for seven, eight, eight seven
dot pi to run it.
We can open terminal in this folder and we can simply type Python three and then the filename.
Hopefully this will give us some help menu that will tell us how exactly can we run this program.
In this case, the help menu says error.
The following arguments are required euro, which is pretty common sense.
We need to specify which target are we attacking with this exploit?
And in our case, it will be this target.
So it's Copi, the IP address to our online bookstore.
And let's go back to our terminal and run our exploit like this.
Let's paste, clipboard and press enter.
Do you wish to launch a shell here?
Let's specify why for us, and here it is.
We opened a remote command shell and now we can execute the comments on the target system.
If I type who am it will be the result if I type.
It will also give me the result.
And now I'm pretty much on that machine.
I can do whatever I want on it.
And this is the power of exploiting outdated version of software.
We got the remote code execution vulnerability and now to finish it off.
Let's go right here, let's copy the comment that they tell us to run.
Let's paste it right here and run it, and the output that we get is one six one one, let's kopi that
specified right here as our answer and submit.
And it's the correct answer.
So you saw how serious this can be, you can be protected by all of these bugs, such as Eskil injections,
such as access has injection, Xixi and all the others that we covered.
But if you're running outdated software with a known vulnerability, there is most likely going to be
a code out there online or an expert out there online that we can just download and run and get straight
into that machine.
We pretty much gained access to it in two seconds from running this exploit.
But even when you find something like this, that's not where you want to stop, there could be other
vulnerability as well.
For example, we did notice.
Let me go back, we did notice another link right here that is from Exploit DB.
Oops, I have no idea where I went.
Yeah, it's this link right here from Exploit DP and it could be another expert.
So we want to take a look at that one as well.
And this one seems to be in HDP request, let's read through it, CSC bookstore is vulnerable to end
authentication bypass vulnerability on the admin panel.
By default, the admin panel is located at Edmondo.
And the administrator interface can be accessed by unauthorized users exploiting the ESKIL injection
of vulnerability for already familiar with Tasco injection.
So let's give it a try.
Why not?
Even though we found a vulnerability and finish the task, we still want to discover all the other vulnerabilities.
So let's see, how can we access the admin panel without actually manually adding slash admin?
And here is the admin login page.
Let's click on that.
We get the login screen.
So let's try with the basic SSL injection test.
Single quote or one equals one with single quotes and we use the same thing in the work.
Let's submit this.
Oops.
Yeah, we're logging in as admin.
We don't really want to use the actual injection as the name.
We only want to use it as the password.
So here we are simply going to type single code space or single quote.
One single quote equals single quote one.
Let's submit the query and here it is.
Our escrow injection worked and we found the second vulnerability and now we're logged in as ad hoc
is that we even use knowledge from some previous section to exploit another vulnerability on this page.
Quote, Now that we covered this for long enough to cover one more thing in the next lecture, which
is called Insufficient Logging and monitoring.
See there.