Hey, guys, welcome back to another episode on How to Hack, and today we'll be discussing about server
site request forgery.
And once again, we're back to Web.
SWEPCO is a vulnerable Web application platform for us to do all of a Web application penetration testing
on.
And in this case, we have a server site request forgery.
So this is the part where a hacker can abuse functionalities in a service by manipulating and changing
configurations, accessing internal resources and so on.
So this is what we call a server site request forgery.
And a lot of these attacks can come from unsanitized user input, directly inputting and changing sort
of data that is being submitted to the user L..
All right.
So all these ways are able to let the hackers gain, control the server and run site instructions without
altering successes.
OK, so here on lesson number two, we have an example.
So if I click on Steal the Cheese, I see over here, I change the channel, the display, Jerry.
And it is this case, of course, is states you feel just due to cheese.
So what we need to do now is actually to go ahead and start up berp.
Sweet.
So let me go ahead and sort of sweet, OK, sweet over here.
And it will begin running burps environment.
So I'll go ahead and click on Temporary Project, click next and click on Start Burp.
OK, so once you do so you have burps sweet running.
OK then we can go on 30 proxy tap and we can click and able.
So in this case I'm going to change the you bind to port as one, two, three, four, four, eight.
OK, click OK on that.
So you have now your proxy intercept is on and I can go on dirty web browser again or so ago, the top
right corner of your browser, click under menu and click on preferences.
So once you're on preferences, scroll all the way down, scroll all the way down and you can click
onto net work settings.
So once you click on the network settings, so like manl proxy configuration and in my case one two
seven zero zero one followed by Port eight eight eight eight.
So this will allow Berp Suite to help intercept and look at all this data is being sent to and fro between
a server and a browser.
So go and click OK on that and begin.
We're beginning to see all this data traffic coming in and out between the browser and the information.
OK, so going back to the website, I can go and click on Stylesheets now go back to Bourbon Street
and I'm going to drop this particular get I'll write a second one.
And over here, this is the one that we're looking at.
So in this case, right, we can look at the post, we can look at the host, we can look at the user
agent data, the descent into the Web browser.
So you can also do certain user agent manipulation, whether we may cover in subsequent Torosaurus.
And then you have the sub language, you have the encoding and so on.
All right.
In case we have the J session ID.
So we did a tutorial on that already.
And if all these different kookie information.
So over here, what's really interesting is that you are L or as part of the post and we have Tom Dot,
PMG, Tom, and of course going back to the browser, going back to the website, he's changed a URL
to display Jerry.
So in case going back to suite, we can actually just change Tom to Jerry.
All right.
So based on the changes due to your URL, I can go in and click on forward, so click on Follow It on
Bourbon Street and going back to the browser, it says you rock the RF.
All right.
So we manage to change.
Do you are able to display a different image?
Okay, so we were able to capture the data that was supposed to be post the Web server that would give
us a return of result.
And in this case, we manipulated data and now we were able to see all of the information inside the
system so we could also try looking up certain other kind of images, oter kind of tax false documents
and be able to post them straight into the Web server.
All right.
So that's the whole idea of service site request forgery.
All right.
So going to question number three is the following change to your URL to display the interface configuration
with Iev config.
So if you click on Run, I have config.
All right.
So I can go back here, I can drop all this lesson.
So all this assen all the time into the Web application system to ensure that we have the lesson, overview
and Manel.
So quite a lot of them has been sent over already.
OK.
So I think I could go in and drop all of them and all I got to do is to just go ahead, go back to the
cyclone change.
I've to go back to sweet.
OK, so here we have the following post Web Goat SRF task, too.
And right at the bottom, we have to Eurail once again.
Right.
So if Imagists percent to catnapping.
All right.
So if you go and go in for this right now, we can drop the rest and we can go on a web.
Godin's shows us an image of the cat.
So in this case, we're going to change it to interface configuration.
And I have conflict pro.
So I'm going to drop all this information now and I'm going to go back to Web, go click on the command.
All right.
Go back to Sweet.
OK, and we have to task, too, so all I got to do is just change days to TPE, all right, followed
by the two dots double slash, followed by I-F config probe and see what we get as a result of it.
Cluett and click forward.
And we can go on the Web, go to gain indices over here, rock the SRF and we can see all the details
here.
All right, we have to force information and so on and so forth, so all this different data has been
pulled in.
And of course, if we go to the final lesson, right, so it's very important for us to be able to not
just prevent cross site request forgery, but also in terms of service request forgery.
What hackers could be using your system, your platform as a launch pad to run all this cyber attacks
against all the devices or even against internal network devices, which could be a database system,
which could be another computer and other network switch router.
And the list goes on.
All right.
So once again, I hope you've learned something valuable in today's tutorial and you have any questions.
Feel free to leave a comment below.
Try my best to answer any of your queries and will share subscribe the channel so that you can be kept
abreast of the latest cyber security to target.
Thank you so much once again for watching.