Hello, everyone.
So in this video, we are going to see how can we identify elephant vulnerability onto a given particular
Web application, so it is the practical time.
And let's quickly jump onto the practical to see how can we actually identify and exploit this vulnerability.
So as you can see over here, I'm onto a target application, which is test BHB, dot dot com.
And once I'm onto this particular website, what I'm going to do is I'm going to set up box with this
website.
As you can see, I'm running on to the latest version of Boxwood, which is twenty twenty point nine
point one.
Now, I have also been running when pope pursued instance of one point seven point three four.
So basically I'm running two instances of pursuit just to differentiate between both the Boxwood versions
and how they work and how we can utilize them for identifying elephant based on liabilities.
So because of limited options into Pope 2.0 that we cannot crawl or use Spider onto the target web application.
I'm going to demonstrate this attack with the help of one point exclusion, which can be freely downloaded
from the sports website.
All right.
So once I have set it up, the biopsy at one point there in vision with my target browser, that is
Mozilla Firefox, I'm going to intercept this particular application and I'm going to bring the particular
request in.
Bob, as you can see on the screen now, I will just reload this and you can see I have got the successful
request over here.
Now I will simply right.
Click and click on Repeater because I want to use this request later on.
Also, I will again.
Right.
Click and send this to spidered.
I'm sending this to Spider because I want as many as endpoints for this specific target.
Remember, if I'm increasing the scope for my target, that means I may get a lot of parameters that
may turn out to be one level and I can identify a valid LFR based vulnerability.
That's why putting this to Spider is very important.
Now it sometimes may ask you to submit the forms it come across onto any target web application if you
want to submit.
Again, some met with some random or junk data or you can simply ignore it.
For now, I'm going to ignore this form.
All right, now let's go back to Target, and you can see this is my target web application on which
I'm performing a test and trying to identify a valid elfy based vulnerability.
Now, I will just right back over here and click on Add to Scope.
I have already done this before and this has added to my scope.
Remember, whenever you're sending any target application for spidering, it will ask you to add to
scope as I've already done this.
You can see now it is showing option which is removed from school.
All right.
So once we have done this, I'm going to again send this to Spider just to crawl more end point so that
we get more parameters.
And it was group and it was group gets increased.
Now, you can see over here there are all the particular Yuans which have been called.
Now I'm going to filter them based on parameters or you can see I'm going to sort them based on parameters
so you can see where your are, all the parameters that can be seen or all the endpoints that can be
seen for a target application.
Now, if you're testing on an application which has multiple endpoints or has a very big scope, there
would be thousands of you are told that will be crossed by boxwood.
And in those circumstances, it may get difficult for you to choose each.
You are one by one to identify which one to test.
Now, for that, what you can do is you can simply use the search feature.
How to do that?
Just go pop and click on search.
Now, as we know, there are some of the specific set of injection points or one parameters for elfy
based vulnerability, and you can simply search those one labeled parameters.
I'm going to attach the list of parameters in to the description and then you can download it and you
can identify those parameters as well.
Now, one of the is file equals to this parameter means that my target application is going to show
a file that can be any file.
Let's say it is a PDF file, a PDF file, a PNC or audio file.
So the file is stored on the target server and it is going to give that file to any user when the user
want wants that particular file.
So what if instead of that particular file, we request for something else to the target server?
Maybe if there is one liability, we may get that intended file by the attacker.
So let's quickly identify these parameters if they do exist or not.
Over here, you can see I'm using the option, which is case sensitive and the locations is only request
headers because I want this parameter in my request headers and request body, not in the response.
Why?
Because in the request itself, I'm going to request for another file, which is W.T. It is zero or
something which is sensitive and Ataca can take advantage of.
Now, you can see over here, you can check or uncheck based on from where you want to scan it, so
let's target proxy repeater.
So I'm going to keep these settings that default.
You also don't need to change anything over here.
Now, just hit on Google.
Once you hit on Google, you can see you are able to get all the end points of the target, which was
just BHP dot will involve dot com and these all your orders are coming from the target.
Deb, as you can see over here, they are under the site map, which we have already called and saved.
Now you can identify yes, it matches a particular parameter.
I just equals to over here.
Now I'm going to choose one of these and send it to repeater because I want to try Elfy on these particular
requests or these particular parameters.
So you can see this is an image which is getting loaded from the server because the request looks something
like get show image, dot, BHB and file equals to the image name.
You're the image, this one, not GBG.
And on the right hand side you can see the rendered response of one dot and it looks something like
this.
Now what if instead of this one dot file, I want to include something else, let's say something sensitive
from that specific server.
So what I'm going to include is ETEK past W.T. file.
Remember, this past WTU file is considered sensitive for any server because it contains the name of
the users and the attacker is able to enumerate the names of the users onto that particular server which
is running.
So you can see where I'm going to send the request and you can see we got an error.
Now I'm going to add dot, dot, slash and you're able to see successfully.
I'm able to see the past W.T. file.
Now, why did I add the dot dot slash?
That is only because to get one step out of that particular directory or go one step back of that particular
directory and you can see over here, I'm successfully able to see the past uploaded file into my response.
Now, this is considered as sensitive because now I can read any of the files I want from the Target
Web server.
I hope you guys understood how you can also identify LFA based on liabilities from any target application,
if the input is not sanitized and anyone is allowed to read any sensitive files from rebel parameters
like file equals to onto any target application.
Thank you.