1 00:00:32,256 --> 00:00:37,120 Engine bikes 2 00:02:51,008 --> 00:02:57,152 Exercise please Episcopal International 3 00:02:57,408 --> 00:03:02,784 Sebastian implant-supported 4 00:09:15,263 --> 00:09:21,407 Completed exercise please update the polling channel so we can move forward 5 00:12:08,831 --> 00:12:14,975 Listen to password 6 00:12:15,231 --> 00:12:21,375 Wonderful blind application 7 00:12:21,631 --> 00:12:27,775 User address and that is most recent password to BHP? 8 00:12:28,031 --> 00:12:34,175 Into Connecticut 9 00:12:34,431 --> 00:12:40,575 Based on this information email parameter 10 00:12:40,831 --> 00:12:46,975 Address.com 11 00:12:47,231 --> 00:12:49,279 Oster do this 12 00:12:49,791 --> 00:12:55,935 Exotic 13 00:12:56,191 --> 00:13:02,335 Because I'm taking the user 14 00:13:02,591 --> 00:13:08,735 Taking a probiotic 15 00:13:08,991 --> 00:13:15,135 Just take me from the Treetops 16 00:13:15,391 --> 00:13:21,535 What is sterile multiple validation in the pocket 17 00:13:21,791 --> 00:13:27,935 What's me up done you just initiated a password for the user to 18 00:13:28,191 --> 00:13:34,335 Teacher.com again 19 00:13:40,991 --> 00:13:47,135 What do user to access 24.com in this time 20 00:13:53,791 --> 00:13:59,935 Speak user if the user has initiated a password reset process 21 00:14:00,191 --> 00:14:06,335 It allows to do so 22 00:14:06,591 --> 00:14:12,735 So 23 00:14:12,991 --> 00:14:19,135 History 24 00:14:19,391 --> 00:14:25,535 Chips on the link and then issues 25 00:14:26,815 --> 00:14:30,143 The second one 26 00:14:30,399 --> 00:14:36,543 I believe everyone knows about what is denial of service 27 00:14:43,199 --> 00:14:49,343 Locked out of user after invalid attempt of the login process 28 00:14:50,367 --> 00:14:56,511 In order to result in order to reset the password of 29 00:14:56,767 --> 00:15:02,911 All different and then 30 00:15:03,167 --> 00:15:09,311 Didn't this time window wife my phone and 31 00:15:09,567 --> 00:15:15,711 Doing a locking again 32 00:15:15,967 --> 00:15:22,111 Another three request start the automatic 33 00:15:22,367 --> 00:15:28,511 The invalid login to that specific user and the user's Arlington Texas 34 00:15:28,767 --> 00:15:34,911 User always remain into a lock State because my automated 35 00:15:35,167 --> 00:15:41,311 Always send three more episodes 36 00:15:41,567 --> 00:15:47,711 And that is logical 37 00:15:47,967 --> 00:15:54,111 Is predictable in nature and has implemented 38 00:15:54,367 --> 00:16:00,511 In that case we can simply brute-force the next stalker and then use this Mexican to reset the password of any of these 39 00:16:00,767 --> 00:16:06,911 Abusing 40 00:16:07,167 --> 00:16:13,311 Heather sub before jumping into the attic let's understand what is hdp horse 41 00:16:18,175 --> 00:16:20,735 Epoxy tool 42 00:16:24,831 --> 00:16:30,975 Daddy supposed request AB contains 43 00:16:31,231 --> 00:16:37,375 The domain name of the application 44 00:16:37,631 --> 00:16:43,775 Hdb 1.1.0 application 45 00:16:44,031 --> 00:16:50,175 But after hdb 1.1 we can. Multiple application on the single cell 46 00:16:56,831 --> 00:17:02,975 Information from the request in based on this posted information 47 00:17:03,231 --> 00:17:09,375 Respective application status 48 00:17:09,631 --> 00:17:15,775 Information data 49 00:17:16,031 --> 00:17:22,175 Where some of the information to crafty password is Atoka 50 00:17:22,431 --> 00:17:28,575 Application use this information to grab the password reset 51 00:17:28,831 --> 00:17:34,975 Are you sure when click on this particle link token 52 00:17:38,815 --> 00:17:44,959 Who protects against validation implement 53 00:17:51,615 --> 00:17:57,759 This kind of attack unusual indoor plant application 54 00:17:58,015 --> 00:18:04,159 Divorce information form example.com 55 00:18:04,415 --> 00:18:10,559 Does the example.com porcelain permission from requested at academy.com 56 00:18:10,815 --> 00:18:16,959 Applications 57 00:18:17,215 --> 00:18:23,359 When are you 58 00:18:23,615 --> 00:18:29,759 Weather 59 00:18:42,815 --> 00:18:48,959 I usually come up with an argument like 60 00:18:49,215 --> 00:18:55,359 You can't do much here because it's kind of late but we will see some of the work 61 00:18:55,615 --> 00:19:01,759 Please do not use devotion information to craft in any of the URI 62 00:19:02,015 --> 00:19:08,159 How to spell reputation 63 00:19:08,415 --> 00:19:14,559 After sometime 64 00:19:14,815 --> 00:19:20,959 1 2 3 testing 65 00:19:21,215 --> 00:19:27,359 Went ahead again tasted Assemble example.com 66 00:19:27,615 --> 00:19:33,759 But this time 67 00:19:34,015 --> 00:19:40,159 You still assume that the information to grab the password 68 00:19:40,415 --> 00:19:46,559 We have replaced this example.com article.com 69 00:19:46,815 --> 00:19:52,959 Example.com and this time we have received this information 70 00:19:53,215 --> 00:19:59,359 Academy.com example.com 71 00:19:59,615 --> 00:20:05,759 Father's Day using the sub string bass. Put Alexa. 72 00:20:06,015 --> 00:20:12,159 Setting of deposition information 73 00:20:12,415 --> 00:20:18,559 Example.com domain information Easter with Indy 74 00:20:18,815 --> 00:20:24,959 Information but still 75 00:20:25,215 --> 00:20:30,847 Send flight information 76 00:20:31,103 --> 00:20:37,247 So he's asked for the at the moment 77 00:20:37,503 --> 00:20:43,647 Resend the normal request 78 00:20:43,903 --> 00:20:49,023 Academy.com 79 00:20:49,279 --> 00:20:55,423 But the moment we replace this example.com example.com we have received 80 00:20:55,679 --> 00:21:01,311 Particle Lincoln daddies.com place example.com and password 81 00:21:02,335 --> 00:21:08,479 The beast on that our next exercise will go to bypass before student validation Tupac 82 00:21:08,735 --> 00:21:12,319 Capture the password 83 00:21:12,575 --> 00:21:18,720 Change the password account using pickup chattanoogan.com 84 00:21:18,976 --> 00:21:21,024 Accomplice audible password 85 00:21:21,280 --> 00:21:27,424 Use an account with a valid email address because it will send a password reset link 86 00:21:34,080 --> 00:21:40,224 Keeping mind.com on domain 87 00:21:40,480 --> 00:21:46,624 Some of you might not have your own domain 88 00:21:46,880 --> 00:21:53,024 Martin play sports 89 00:21:53,280 --> 00:21:59,424 Alderman information information and when the victim 90 00:21:59,680 --> 00:22:05,824 Domain 91 00:22:06,080 --> 00:22:12,224 Purpose of this exercise 92 00:22:12,480 --> 00:22:18,624 Entry so let me show you that that's why 93 00:22:20,672 --> 00:22:26,816 Cancel the moment you look at 94 00:22:28,352 --> 00:22:34,496 Uc.com. 95 00:22:34,752 --> 00:22:40,896 Toodle-loo address 96 00:22:41,152 --> 00:22:43,968 Access this particular 97 00:22:52,160 --> 00:22:58,304 So what can I do to play with 98 00:23:11,360 --> 00:23:17,504 Sephora tarte let me start defeating insulation 99 00:23:17,760 --> 00:23:23,904 Revelation by the question 100 00:23:24,160 --> 00:23:28,768 Simply post-recession on the basketball Channel 101 00:38:26,304 --> 00:38:30,656 Cancel 102 00:38:31,680 --> 00:38:37,824 So let me apologize 103 00:38:38,080 --> 00:38:44,224 Exercise 104 00:38:44,480 --> 00:38:48,832 Start my car 105 00:38:57,024 --> 00:38:59,328 Lockdown dacian 106 00:39:00,352 --> 00:39:02,400 Go to login page 107 00:39:02,656 --> 00:39:05,216 Google password page 108 00:39:05,728 --> 00:39:11,872 CO2 109 00:39:18,528 --> 00:39:19,552 Straight 110 00:39:20,832 --> 00:39:26,976 So let me start in India 111 00:39:27,232 --> 00:39:33,376 Moshe name to use this particular. 112 00:39:34,912 --> 00:39:41,056 History of Russia 113 00:39:41,312 --> 00:39:47,456 Information 114 00:39:47,712 --> 00:39:51,296 It will make a request to dispatch 115 00:39:51,552 --> 00:39:57,696 The format to the Duluth 116 00:40:02,816 --> 00:40:07,168 Hgtv.com 117 00:40:07,424 --> 00:40:13,568 No school today email address to all the inbox of that particular user 118 00:40:13,824 --> 00:40:18,944 Lantus.com 119 00:40:21,248 --> 00:40:24,320 Go to my email 120 00:40:27,904 --> 00:40:34,048 So he received a reset password link or email address 121 00:40:34,304 --> 00:40:40,448 Richest capture this request 122 00:40:40,704 --> 00:40:46,848 Now this military-based ideal options 123 00:40:47,104 --> 00:40:53,248 Will create some link ID in the back and in the 50s 124 00:40:54,016 --> 00:41:00,160 And you see us today 125 00:41:02,720 --> 00:41:08,864 The moment we do this you see now it's initiated a request to the application and that is Atticus 126 00:41:15,520 --> 00:41:21,664 Application 127 00:41:24,224 --> 00:41:30,368 Respond something something blah blah blah 128 00:41:37,024 --> 00:41:38,304 Information 129 00:41:38,816 --> 00:41:44,960 Access 130 00:41:51,616 --> 00:41:57,759 Anna says Sanjay dutt millionaire.com 131 00:41:58,015 --> 00:42:04,159 Ebcd Edgerton 234 ABCD 132 00:42:04,415 --> 00:42:06,463 Make me scream. 133 00:42:06,719 --> 00:42:08,255 Recent 134 00:42:08,511 --> 00:42:13,375 I just use the two conduct were received 135 00:42:14,143 --> 00:42:20,287 Gmail address password new password is 1234 136 00:42:20,543 --> 00:42:26,687 Bloomington Center 137 00:42:34,367 --> 00:42:37,439 ABCD address 138 00:42:47,679 --> 00:42:53,823 Successfully logged in 139 00:42:54,079 --> 00:43:00,223 My question to you is that 140 00:43:10,975 --> 00:43:17,119 Define application is lettershoppe 141 00:43:18,399 --> 00:43:23,263 And there's another application letter blog 142 00:43:23,519 --> 00:43:29,151 This talk of Education again that information 143 00:43:39,647 --> 00:43:45,791 My question to you is that within this particular configuration 144 00:43:46,047 --> 00:43:51,167 Addition bypass attack 145 00:43:55,263 --> 00:44:01,407 Yes or no yes or no 146 00:44:07,551 --> 00:44:10,879 I believe you understand the question right 147 00:44:20,351 --> 00:44:26,495 The first one is the swap application the second one is the top 148 00:44:26,751 --> 00:44:32,895 Application application is certified application 149 00:44:33,151 --> 00:44:39,295 Application that uses the information to grab the password is a thing now 150 00:44:45,183 --> 00:44:47,743 The moment 151 00:45:01,567 --> 00:45:07,711 Send this.com 152 00:45:10,015 --> 00:45:16,159 Are we able to perform valuation bypass 153 00:45:16,415 --> 00:45:18,719 Orthostatic hypertension 154 00:45:26,399 --> 00:45:31,007 So there is an interesting concept away here 155 00:45:31,263 --> 00:45:37,407 Selected application which uses emotional information to class B+ 156 00:45:37,663 --> 00:45:43,807 Based on the information if it's not a default application then it's not 157 00:45:50,463 --> 00:45:56,351 Information 158 00:45:56,607 --> 00:46:02,751 This particular horse is not exist of on any of the web application 159 00:46:03,007 --> 00:46:09,151 It will forward this request to the default application into virtualbox in virtualbox environment 160 00:46:09,407 --> 00:46:15,551 Application now this is the link account 161 00:46:15,807 --> 00:46:21,951 Password but this particular application 162 00:46:22,207 --> 00:46:28,351 And it might be possible that this particular Handler has not returned within the shop application 163 00:46:28,607 --> 00:46:34,751 Message smartphone 164 00:46:35,007 --> 00:46:41,151 DB application that is one of the three presidents to be our default 165 00:46:41,407 --> 00:46:47,551 Application didn't watch unboxing 166 00:46:55,487 --> 00:47:01,631 Okay so what are you going to do lunch break so let me add one out of lunch break and 167 00:47:01,887 --> 00:47:07,775 All my 15 minutes of defeated Creek 168 00:47:18,527 --> 00:47:23,903 25 minutes 169 00:47:24,159 --> 00:47:30,047 Exercise pic 170 00:47:35,167 --> 00:47:41,311 If you have any questions regarding this topic or any of the 171 00:47:41,567 --> 00:47:46,943 You can simply poster passion in the barbershop 172 00:47:47,199 --> 00:47:48,991 The best guys 173 00:49:30,623 --> 00:49:36,767 Check about how do we 174 00:49:37,023 --> 00:49:43,167 Able to identify 175 00:49:43,423 --> 00:49:49,567 Chords to the new invite 176 00:49:49,823 --> 00:49:55,967 Again 177 00:49:56,223 --> 00:49:58,271 HTP 178 00:49:58,527 --> 00:50:04,671 Let's do the business logic first 179 00:50:04,927 --> 00:50:11,071 He's having a very complex in order to perform this function so 180 00:50:11,327 --> 00:50:17,471 Example of the application 181 00:50:17,727 --> 00:50:23,871 You flash a late-nighter 182 00:50:24,127 --> 00:50:30,271 Address information 183 00:50:30,527 --> 00:50:36,671 This payment information and all this information is collected by the application then you are able to place 184 00:50:36,927 --> 00:50:43,071 Chain of function that is this modification 185 00:50:49,727 --> 00:50:55,871 So 186 00:51:02,015 --> 00:51:05,343 It's a you are you have a product 187 00:51:06,367 --> 00:51:12,511 X100 188 00:51:12,767 --> 00:51:18,399 A single quantity for that so your order total become hundred-dollar 189 00:51:20,703 --> 00:51:26,335 Let's say you are adding another 190 00:51:30,175 --> 00:51:36,063 $50 and he 191 00:51:36,319 --> 00:51:42,463 Order total for that particular product 192 00:51:42,719 --> 00:51:48,863 Annual final order total pickle 193 00:51:49,119 --> 00:51:55,263 Now what is there is no relation in the back end for the product 194 00:51:55,519 --> 00:52:01,663 And if you apply the negative 195 00:52:04,479 --> 00:52:10,623 Under $200 196 00:52:23,679 --> 00:52:29,823 XYZ 197 00:52:30,591 --> 00:52:36,735 What is in the back of the snow condition about whether this potato coupon code is applied or not 198 00:52:36,991 --> 00:52:43,135 Applying this coupon code again 199 00:52:43,391 --> 00:52:49,535 144 200 00:52:50,047 --> 00:52:56,191 So what does what I can do 201 00:52:56,447 --> 00:53:02,591 Discount. Apartipridact 202 00:53:09,247 --> 00:53:15,391 Alteration difference between 203 00:53:15,647 --> 00:53:21,791 Is the process to verify the user has exited after completing 204 00:53:28,447 --> 00:53:34,591 Application 205 00:53:34,847 --> 00:53:40,991 Information on your profile information deposit information 206 00:53:41,247 --> 00:53:47,391 Information you do not want to see other user 207 00:53:47,647 --> 00:53:53,791 Your information and for that reason 208 00:54:00,447 --> 00:54:06,591 Identify this operation the first one is 209 00:54:11,967 --> 00:54:14,527 The barometer tempering 210 00:54:14,783 --> 00:54:20,671 And the second one is g-force browsing 211 00:54:20,927 --> 00:54:27,071 Account 212 00:54:27,583 --> 00:54:33,727 Class balance 200 213 00:54:33,983 --> 00:54:40,127 Respond with the balance information now 214 00:54:40,383 --> 00:54:46,527 Decided 215 00:54:53,183 --> 00:54:59,327 Isn't that the second 216 00:54:59,583 --> 00:55:04,703 User wrote interpretation the first one is less than normal user 217 00:55:05,471 --> 00:55:11,615 And the second one is less a admin user 218 00:55:11,871 --> 00:55:18,015 All user info. 219 00:55:18,271 --> 00:55:24,415 Are you a dead Minister try to access this particular page application respond with Auntie 220 00:55:24,671 --> 00:55:30,815 Information that is there for that particular application from the office now 221 00:55:31,071 --> 00:55:37,215 If he forcefully try to access this particular page using the normal and if 222 00:55:37,471 --> 00:55:43,615 Respond with all user information than this is the authorization by buses in Gulfport 223 00:55:53,343 --> 00:55:59,487 Identify the independent activity but you might do not know this is called 224 00:55:59,743 --> 00:56:05,887 Programming language 225 00:56:06,143 --> 00:56:12,287 Spider-Man Spider-Man for the spring and svo2 binding for the PS3 application 226 00:56:12,543 --> 00:56:14,591 Object injection 227 00:56:15,359 --> 00:56:18,687 Enhancement 228 00:56:18,943 --> 00:56:23,551 Awesome 229 00:56:24,063 --> 00:56:30,207 Applications 230 00:56:30,463 --> 00:56:36,607 Definition mode in place that is available 231 00:56:36,863 --> 00:56:43,007 Create an application on top of it without creating 232 00:56:43,263 --> 00:56:49,407 Classes 233 00:56:49,663 --> 00:56:55,807 Variable 40 common processes like study station Elizabeth password login 234 00:57:02,463 --> 00:57:08,607 Glasses without reviewing it 235 00:57:08,863 --> 00:57:15,007 Diamond 236 00:57:15,263 --> 00:57:21,407 User class directly to the registration page application 237 00:57:21,663 --> 00:57:27,807 Tidy username is admin first name last name and address 238 00:57:28,063 --> 00:57:34,207 Registration process username for steam last name and address 239 00:57:34,463 --> 00:57:40,607 Ask for the ascending parameters 240 00:57:47,263 --> 00:57:53,407 Create a new user with a edmundites instead of normal 241 00:57:53,663 --> 00:57:59,807 Beautiful one smaller able to such a while forceful injecting this is admin parameters 242 00:58:07,231 --> 00:58:13,375 So based on that our next exercise Bellevue Escalade TOP English songs 243 00:58:13,631 --> 00:58:19,775 Medusa 244 00:58:20,031 --> 00:58:26,175 Accomplice DPS list user 245 00:58:26,431 --> 00:58:29,759 How to be identified 246 00:58:34,367 --> 00:58:40,511 So the tenant 247 00:58:40,767 --> 00:58:46,911 Profile update page. 248 00:58:48,191 --> 00:58:54,335 Let me show you first what is towns became as a normal user so I'm just locked 249 00:59:00,991 --> 00:59:06,111 What time selecting Wood mobile 250 00:59:07,391 --> 00:59:13,535 Survive before time not getting any of the numbers 251 00:59:13,791 --> 00:59:19,935 LeBron James 252 00:59:26,591 --> 00:59:32,735 XSport exercising 253 00:59:32,991 --> 00:59:39,135 A walkthrough and then I'll give you time to complete this exercise 254 00:59:39,391 --> 00:59:45,535 So anyone has any question question question 255 01:14:36,671 --> 01:14:40,767 Complete this one 256 01:14:41,279 --> 01:14:47,423 Philippine give you a box to sp06 people are doing this exercise 257 01:14:47,679 --> 01:14:48,959 Show 258 01:14:49,215 --> 01:14:52,799 Go to my calendar 259 01:14:53,311 --> 01:14:59,455 Identify the parameter 260 01:14:59,711 --> 01:15:05,855 Eunice from the browser 261 01:15:06,111 --> 01:15:12,255 Click on this email address information about 262 01:15:12,511 --> 01:15:18,655 The membership under this 263 01:15:18,911 --> 01:15:25,055 My name is sunshine mobile 264 01:15:25,311 --> 01:15:27,615 123123 pedo 265 01:15:27,871 --> 01:15:34,015 Interbox Street 266 01:15:34,271 --> 01:15:40,415 Update it has no information about the membership 267 01:15:40,671 --> 01:15:46,815 I just want to identify the parameter 268 01:15:47,071 --> 01:15:53,215 Revealing this information like membership and that is brunch 269 01:15:53,471 --> 01:15:56,543 Ballistic Lincolnton 270 01:15:56,799 --> 01:15:59,103 Again 271 01:16:00,639 --> 01:16:06,783 It was sent this particular request the backing into parking for this 272 01:16:07,039 --> 01:16:13,183 An interest once you see information about the membership and that is bronze 273 01:16:13,439 --> 01:16:19,583 So there is a valid values like gold Platinum ends on 274 01:16:19,839 --> 01:16:25,983 Let's try to inject a spirometer 275 01:16:26,239 --> 01:16:32,383 Song Brain Stew cold-weather depiction accepted 276 01:16:32,639 --> 01:16:38,783 Say Yes except Edition couldn't face that user accounts and J. And it says Android 277 01:16:39,039 --> 01:16:43,391 Updated successfully now let's check weather 278 01:16:43,647 --> 01:16:48,767 Is changed from browser to call loser. 279 01:16:49,535 --> 01:16:55,679 The moment with this particular page because 280 01:16:55,935 --> 01:17:02,079 Able to identify the endpoint which accepted membership injected 281 01:17:17,183 --> 01:17:22,559 Know if he wants the 20% discount as a membership discount 282 01:17:22,815 --> 01:17:28,959 Cincinnati 283 01:17:29,215 --> 01:17:35,359 Discount 284 01:17:35,615 --> 01:17:41,759 In order to process this is the fake payment Gateway so please do not use your card 285 01:17:42,015 --> 01:17:48,159 Medical information order real critical information 286 01:17:48,415 --> 01:17:52,767 Best rwd 123123 287 01:17:53,279 --> 01:17:59,423 Panties Latifah respond to DVD / 123 288 01:18:10,175 --> 01:18:14,015 Okay 289 01:18:31,935 --> 01:18:37,567 Vietnam 290 01:18:38,591 --> 01:18:44,223 Century 21 291 01:18:45,759 --> 01:18:50,367 123 292 01:18:55,999 --> 01:19:00,095 And yes we are able to successfully two dependents 293 01:19:00,351 --> 01:19:06,495 And it's only charged to 32GB 294 01:19:06,751 --> 01:19:12,895 So this is how we can identify tomorrow salmon 295 01:19:13,407 --> 01:19:19,551 This is kind of a simple right before the parameter that is there in the profile 296 01:19:19,807 --> 01:19:25,951 To file information 297 01:19:26,207 --> 01:19:32,351 15 / box tasting and there is a black box 298 01:19:33,887 --> 01:19:40,031 Identify the hidden parameters 299 01:19:46,687 --> 01:19:52,831 Identify this massive famine 300 01:19:53,087 --> 01:19:59,231 Identify search 301 01:19:59,487 --> 01:20:05,631 Request 302 01:20:05,887 --> 01:20:12,031 Debussy place is basically modified Saturn 303 01:20:12,287 --> 01:20:14,080 Stifel application 304 01:20:18,688 --> 01:20:23,552 The second one is you can simply use this tool bottom liner 305 01:20:24,064 --> 01:20:26,624 Someday soon. 306 01:20:35,072 --> 01:20:41,216 It's basically allow me to identify the hidden or the encanterra M from the application 307 01:20:41,472 --> 01:20:45,056 Parameters that is there 308 01:20:45,824 --> 01:20:51,968 So this is how we can approach identify such vulnerabilities 309 01:20:55,296 --> 01:21:01,440 What are pulses Peru 10 moments to complete this exercise that will move to the next one 310 01:21:01,696 --> 01:21:07,840 Regarding this particular topic 311 01:21:08,096 --> 01:21:11,936 Disguise 312 01:21:13,216 --> 01:21:18,592 And once you completed exercise please update the polling John Legend