Hello, everyone, and welcome to this video.
So in this video, we are going to see about an interesting one, lability, which is broken link highjacking,
maybe many of you must not have heard about the broken link highjacking or be alleged because it is
quite uncommon type of vulnerability, which is generally missed by a lot of security researchers.
So why are we going to learn about the edge?
Because it is one of its kind of vulnerabilities which is less identified by many hackers and it rewards
good in different programs.
So what is this vulnerability?
So this vulnerability exists when any web application includes file resources, scripts or any type
of data from another Web server, and the links are not active anymore and available to claim.
So this basically means any target web website.
Let's say example, dot com has a lot of links which are being pointed to, let's say another website
with this example, dot com.
But those links are not functional anymore and they are available to be taken over.
This is broken link highjacking.
In this way, any attacker can claim those particular link which are serving the data and can also serve
malicious content to the users.
So what is the motivation of this untouched winnability?
As you can see, this was a poll done in which hacker and security researchers was asked about a broken
link.
Highjacking do actively look for broken links on BHAVANI programs only to say yes.
And then security researchers said no.
They do not identify a broken link highjacking on many big bounty programs.
Now, this sounds a lot like a subdomain because in which we take over the subdomains of target programs,
but in this we are going to take over not the subdomains, but the resources, the links which are already
there into the Web application.
So let's understand this with the help of a figure, as you can see, onto the left hand side is the
attacker and the right hand side is the server on which there are some links which are vulnerable.
So let's say the attacker sends a request onto the target server where there is a link of the social
media and let's say it is pointing to Lingnan when the attacker receives a response from the server,
it is not found for 04 or your profile does not exist.
This basically means that the link is broken and is not available on Lingnan.
Thus the attacker quickly signs up on LinkedIn platform and takes the same username which have been
pointed on the server.
This way, the attacker can serve a malicious profile on the server and anyone who comes onto the server
and clicks on the social media of LinkedIn will be redirected to the attacker and will be communicated
to the attackers profile, which he has impersonated and made onto.
This is just not limited to LinkedIn.
They can be many broken links to other social media platforms like Twitter, Facebook, Instagram,
etc. to make this more bad, if they can build links that can be hijacked of S3 bucket as well as JavaScript
files to serve malicious content and pop up exercise based on vulnerabilities as well.
So I hope you guys understood how dangerous it is if these types of issues are not fixed and how what
can be the impact of broken link hijacking?
Now let's understand one more example of broken link hijacking.
This can be a dangerous vulnerability because the attacker can serve malicious content to all the users.
As you can see, under the figure on the right hand side, there is an attacker.
Let's say he wants to identify a script onto the target server.
So let's add a script name is programmed, not S.H. So he clicks onto the website and there he sees
a button of download script when he clicks onto that download script and the server sends a request
to its CDN.
Let's say the script is hosted on the AWB S3 bucket, but the link is broken.
Now the attacker can quickly go onto a W.S., make the same bucket name and serve program dot asset
as a malicious content on malicious file to all its users.
This way, anyone who tries to download the file and execute this file will execute not the legitimate
file from the server, but a harmful, malicious file of the attacker.
So this way the attacker can compromise the security of all the users by serving his own malicious,
executable files.
This way, it increases the severity and criticality of this vulnerability, so I hope you guys understood.
Thank you.