And welcome to this video.
So in this video, we are going to see interesting broken link highjacking report in which a security
researcher was able to identify this issue on one of the program on hacker one.
So let's have a closer look onto this report, which was submitted to a bug bounty program, which is
a great pick.
As you can see, the security researcher was able to identify the issue on a subdomain, which is Greatbatch,
not Berrick, not pro.
Now, for those who do not know what is Pyhrric, it is an alternative for Google Analytics suit.
So these are some of the software or services which are used by many of the organizations to keep track
of their data and to keep track of how many users or customers are landing onto their web applications.
So as you can see, this is an alternative to Google Analytics.
Now, what happened here was that Greatbatch had one of its account on Pavic DOT probe, and this led
to this subdomain takeover, as you can see over here.
Now, actually, the root cause of this was which is mentioned by the program owner.
The issue is that we have stopped using Pyhrric, but it still includes the JavaScript on our pages.
Now, due to this, the subdomain, which is Greatbatch dot dot probe, was still available to claim
by the security researcher, as you can see over here.
So this is clearly Bay Pro and you can see the subdomain is available.
Now, the main thing that arises over here is how did the security researcher came to know about this?
It is just because of the broken links into the JavaScript files.
And due to this, the issue came up and the security researcher was quickly able to escalate it to claim
this subdomain free of cost and show the proof of concept.
So this is, again, a very interesting find.
And you should always remember that JavaScript files can be very, very useful to identify manuals and
to track if they are still valid or that in case they are dead, then at a very, very good for us to
claim those particular URLs if they're pointing onto any cloud service or public services that can be
easily claimed and we can decode that to show the criticality and severity of the issue.
So I hope you guys understood this and learn from this bug bounty report that how you should also look
over all the files and do not miss it.
Thank you.