Hello, everyone, and welcome to this video and this video we are going to see how can you identify
LFR vulnerability into a Web website?
So let's quickly see the practical.
All you can see, we are on to one of the website which is ravaged by dot com on this website that exist,
a particular specific vulnerability, which is LFA.
And I'm going to show you how you can identify that vulnerability.
So let me first quickly start by pursuit and capture the request in my book.
As you can see, I have captured the request in my pursuit and I'm going to send this to repeater in
case I want to use the request later on.
Now, I will also send this request to spidered because I want to call as many as as endpoints I can.
Why I'm calling those endpoints because that will increase the scope and I will be able to identify
some of the certain parameters that can be vulnerable to this one reality.
All right.
So once you send anything to Spider, it is going to ask you to confirm that.
Would you like to add this specific target to the current spidering scope?
And you have to press a yes when you will press.
Yes, it will automatically get added to the scope.
And you can see the spider has successfully started now into the target site map button.
You have to choose your target.
As you can see over here, this is my target.
So I'm going to, again, add to school.
And if I want, I can also spider the host.
Now, when I have my target over here on the right hand side, you can see these are all the particular
you are URLs that have been identified or the endpoints that have been identified for the target application.
Now, I can't use any of the particular request from here to play with and identify if it is vulnerable
to any of the certain attack.
Now, you can see I have took a particular target request, which is going to indicate that BHP slash
page equals to contact DOT BHP.
This particular page represents a contact page onto the particular Target website.
Now, what if I replace the contact dot Page Pate with something else?
Let's say I want to include something else from the target server, which is slash ADC, slash past
W.T. instead of the contact dot BHP file.
And let's see if we are able to see the path to bloody content.
If I scroll down, then you can see over here I'm going to search based on a route called X because
this is how a bloody fi is represented.
But there is always a to use it.
And you can see over here there are two users.
First is route and second is ravaged by dot com user, which has been created under that particular
Linux server.
All right.
So you've you have successfully identified that the variable parameter page is one level to.
LFA based attack, when we are able to read the sensitive content from the server now, you can see
I have changed the payload to ATC slash shadow and I'm trying to read the shadow file.
For those who do not know what shadow file represent, it contains the passwords of all the users into
the system.
And you can see I have the password, but obviously they are not in the plaintext.
They are encrypted.
But they can be decrypted using some of the techniques and we can get hold of the original password
of the user.
Now you're this demonstration shows the venerable barometer page wherein we are able to inject any arbitrary
file and we are able to read that from the target web server, which portrays the LFG vulnerability.
So I hope you guys understood how to perform this attack.
Thank you.