Let us continue with phyla vulnerability in the last previous two lectures, we saw how to exploit the
vulnerability for medium and high, low level.
In this lecture, we will see how to exploit the volatility in the high.
Now, some applications are secured to the level in which we are going to see in this lecture.
So let us test whether we can upload a shell at a high level and how to upload the shell using it.
So you need to do two things.
Start your portable and log to Akali Linux.
So I have logged in to my colleague and I will launch the Firefox.
It has head to do w e.
And make sure that you practice all these things into watching machines, only these videos are only
for educational purposes, do not make illegal use of this knowledge.
So let us go to DPW security and change the security to high summit and then go to upload, let us try
uploading the BHB that we had then.
So first, we need to go and change the file name to BHB again.
Now, let us try to upload this up there to see if we can upload.
There you go.
Your image was not uploaded and since the security is high, we didn't even get a descriptive error
message there.
US try uploading this using boxset.
So go to Bob Sweet.
Vilaboa pursuit starts, let's go to proxy.
They're just like, OK, let's go to proxy.
Let's go to preferences network settings.
Select manual proxy, make sure that the stock market's checked.
OK, now come to Bob Sweet.
Go to proxy, keep interceptors on, go to DeVita.
Click, browse, share them more open upload now in the last lecture.
We changed the name to GPG, so let us check if we can do this.
Click forward.
Again, our image was not appropriate for why why was this happening, let us view the source code.
The intercept on.
Let us view the source code.
So now you can see if it is checking for extensions, that is.
This is allowed.
It is also checking for content type.
So you can see it is checking for GPG, so in our damn bobsled, we just change the name and it was
just checking it if the content is GPG.
But now if you can see in the code, it is also checking the extension.
Right, so we cannot even if we change the name and then transfer, it is not act, it is actually checking
the extension of the file.
So now what to do?
Well, I have one solution for this.
Let us see if this works.
Intercept all of my sweet it is try to upload the same shell again.
And in here, what I will do is I will just change the name to Shell, the MoveOn.
Not BHP, not GPG, and let us see what happens.
So after doing this, the server will think that, OK, it is a start jpg extension, but whenever there
are two extensions in line, the extension, which is first, is considered.
So for the validation purposes sort of thing that OK, it is a Dogpatch extension, but when the actual
file will get uploaded, it will get uploaded as dot BHP file salters just click forward and there you
go.
Our shell was successfully uploaded.
Now, let us check if Shell one was uploaded again, I change the name just for this laptop users who
can keep the name, same if you want, but it is better to distinguish between the names so that you
don't get confused.
So let's see.
And there you go.
It is blank, which means you have successfully uploaded the shell.
Turn off the intercept and let is go to terminal.
And that will connect the vesely.
They will copy this, you are in.
Let's go to our.
Terminal and then based.
Chalamont, GPG, and then followed by Password.
There you go.
We have successfully connected to the we shall let us see if we can execute commands, the Hugo CHIRLA
one shed.
So our original file, Schlomo, which was updated or uploaded in the last lecture, is also present
here and the movement is also present.
Now, why did I change the name here?
Because it may get over it done with the server and that is why I actually changed the name.
So you can see this is how you can also try to intercept and exploit the high level of vulnerability.
Now, most of the applications execute impossible level of vulnerability, which means they are the
cream, the content extension, Len panic, etc., all those things.
So it totally depends upon how the application is executing or deploying this type of file uploads.
But in most of the cases, if you are keen security researcher, you can get some websites where the
high level is also exploitable, but do not use the word shell or do not use this for illegal or malicious
purposes as you are.
You can always get at least back by security experts.
So this is how we actually exported the file approved vulnerability at a high level.
I hope now you have got an idea of what is file uploading that ability and how dangerous vulnerabilities
can be in the next lecture will start with the most important and the most related topic of application
penetration testing.
That is Eskil injection.
I hope you're excited for the next video.
So let us get started with the next video again.
If you have any doubts, please feel free to ask us and we will try and answer them within 48 hours.
Also, if you are really enjoying this course, do not forget to read the course as this will also help
other students and it will also help instructors to know if you are really enjoying the videos.
And please do not forget to write the review for this course.
I will see you in the next lecture.