So in this video, we're going to see the firepower, vulnerability whenever we have this chance to
upload a file image or any extremophile, you can upload this and you can navigate to this file to see
the content.
So on this uploading, we can also upload the reversal in the format of PSP or any other backend of
service running.
And then if you load the file in this, you are then our malicious code will get executed.
So instead of this image where I can select this reversal of this BHP non-Equity.
One BHP Riversdale.
So let me turn off this burp and refresh this page.
So as you can see, I have a couple of websites on this page be reassuring.
So basically we upload this on this website and then we'll never get to that, uh, PSP file to decode
this, uh, payload.
So, uh, Creegan, this one which Russia.
So, yes, I thought I could get this guy to bring you the special called.
And click on this reversal that BHP.
And if you see this right, and if you this is the code for the PSP and Orange to change this, you
need to change this particular color so that the reversionary.
Carol, back to you.
And the poll number are going to leave it as one, two, three, four are to contain this, a press
contrary to the report and controversy.
No, I don't want to raise I want to create a new file.
But to delete or reverse that BHP.
So.
I am going to pay this and I'm saying we're saving it as we possibly know, these are the comments.
We don't need these comments.
This will just increase the PHYLISS, which we don't need that we did all these comments and now we
need to turn this hyper.
So my colonics mission, I wanted to do that one six zero zero one zero four.
So I'm going to leave the one, two, three, four as a normal no press conference, so might I reverse
that?
BHP has been successfully sued for SilkAir.
It was not BHP.
Now, I that down.
OK, that's fine.
Now what we can do is.
So we can just go to this one and Deliberatively Security Bureau and we can upload this image, so in
the low security, we do not have any chance.
We can upload it if you want.
Let me play this.
Uh, it was not so recognizable.
It is on to the retrospect, hackable approach, and it is showing me the path I can just simply go
to here and might reverse the speaker gets it.
So before that, let's set a prisoner on the wall, one, two, three, four to catch our Russia.
So I'm going on listening on this for one, two, three, four.
So whenever I hit enter the code inside this Rossler page, we get a digital.
As you can see, we got.
So we have got the shell and we can pretty much do the prescription from here.
So this is the basics of this fight personality that we control.
Oh, stop this one.
So no sense of personal connection terminated.
So we have to terminate this connection.
Now, this is the basic way of operating the file and there are no restrictions over this.
Now, let's increase the security to Miriam.
Medium and answer.
Now, let's try to approach this, uh, Rosler, BHP and see and it's just not appropriate because it's
only accepting that image file format.
Now, what I can do is I there are some simple tricks to bypass these restrictions.
And I use LCP Rivers, not BHP, to that's a sample, that's a medium which will be recognised as a
medium security medium that BHP that cheap.
Oh, let's say this.
So what I'm doing is I am putting this extraction that and so everything will be as an image.
So now let's try to apply this.
So our image was not a protest to.
So try again.
OK, now let's turn on this proposal to modify some parameters.
So my work is on let me make sure that the design and process.
So we have got this request here, are you going to do this, you need to.
Jane, it's already their much being.
And now let me try to put this up and the father, because to my mind, was not a protest.
So let's try this as, uh, David Guimet.
So we need to try a different file formats.
Sorry.
So maybe the.
So we are just changing the last election from being to a debate.
Now let's see whether we can approach this debate, fair or not.
So let me try to follow this, and you can see so JPEG files are being accepted by our Web browser as
sort of observer.
Now, let me copy this and if I go here.
I think my reserve is running on, yes, it's running on now, let me turn and follow this.
As you can see, we got our share.
So this is on track to bypass these restrictions.
So let me go back.
And what we can do is you need to increase the.
Security level, the height.
So now let's try to operate the same JPEG file.
OK, OK, it's a product I don't know, it's there maybe there is some difference, but we have bypassed
this using word.
Now, let me capture this interceptor.
I will show you some more tricks to bypass this.
So let me start this dollar debate and let me know what we can do here.
You know, there will be a progression or BHP, right?
We need to change this image, our image, our image
and what we can do.
You can put the header of P and G are the header and what you're going to use to find out this Hedera.
All right, now, let me just.
So you need to turn out this.
So there are file formats, this magical header will be identified as a.
So there are some different magic hurdles for different formats and you'll identify the Geopark as well
as starting these various if you it if that need to be considered as it so that, uh, there will be
some magic, uh, files, magic, not magic numbers are the user, the starting header names, header
data that will identify as the file extension.
So in that way, you can just, uh, capture the question to this and you can modify the starting values
and then you can simply, uh, just upload the, uh, code here.
And another way you can do this, you can just certain image files copy.
And I don't have Geopark personal tgp jpeg files and you will get the data here in the pursuit and you
can just edit, edit the data and add your BHP reverser code.
So it just adding the, uh, PSP Russia code at the end of this data.
So, and then you can upload the uh normal.
So my file has been successfully copied this.
So I think, yes, my reasoning is running out.
I get the reversal.
So this is all about this final approval novelty's or you can just try some more extensions also.
So I hope you have understood all the security levels.