Now Liz hunt for the other read Eriksen through the part fragment.
So first of all you simply open this handed and link so it contains all the bug bounty to it.
So simply go on this link and here is the open read addict and the possible open ended addict barometers.
So you could see we have already discussed about this.
That is a Toms if it has any terms like you at all you can inject your target website over there.
But for this leg so we'll see the open related to the bat fragment.
So we'll just target this Web site over here.
So let's see if this works or not.
So first of all we have the link over here.
That is the Google and basically will have the read Erickson to Google dot com.
If it this work or if any of these belong to work so let's try one by one.
So let me just copy this go over here.
So what do you need to do is at the last of the link you need to simply paste because this is your new
payload.
So if I just seed into and it is saying 4 4 that means nothing found.
So if this is the case then there is no open you are a grid Erickson in these parameter or in this field
or with this payload.
So this pillar is not working for this link because we simply get four four so four and 400 for you
that is not found either.
That means it is not working.
So let's strive for another payload again so you can get this payload from the resource section.
So at the last of the link you need to simply paste this one.
And if I hit enter again it soon so for year that is again not found.
Let's see.
Try this one.
Let's go over here and let me just paste and let me just sit in there.
Then it is saying 403 forbidden.
This means you are not allowed to do this.
Is this this information.
So it is also not a valid.
Let's go over here and list space to the next payload and it is also saying it is not valid.
Let's go to the next payload.
This is another pillar so let me just copy this and go to hear it and paste it over here.
And if I just hit enter then it has been redirect to Google dot com.
So you could see this pillar is working for this link so you can simply copy this.
That is a payload.
You can simplify this payload at the end so it has already fired.
So if I just hit enter or if I just replace this again then you could see this is our new link.
And if I just hit enter or you can simply copy this and give it to something that is new browser or
basically new user you can also make use of some online services like Bickley which will this encode
your your URL or basically certain that you are all and give them your URL.
That is not suspicious enough so you can simply paste it down here your link and let me just copy this.
The new link.
OK.
Let me again let me just copy out this link and it should give me OK.
There was a pause here.
Copy this paste it over here.
And as a certain copy this link and give it to the new user.
And this is my new private user.
Let me just copy this.
Then it will be redirect.
We wait for moment.
It should give you open read Erickson but it is not working because it has not encoded properly so it
should be like this.
So if I just give this you or do any browser then it will this redirect to Google dot com and you could
see it is not a deal or journal or sadness dude.
It is the new Web site or there is a you are a leader Alex and it is not going in the original content
is true it is going in the Google dot com so instead of Google dot com you can have here the malicious
will say if you have any malicious Web site use will be related to that Web site or it can be also the
clone Web site and you can simply grab the content or harvest the credentials of the user with this
neural redirection so you can also see this link over here which has a bunch of over open redirect.
So all you need to do is simply paste that payload which is just given over here at the last of a link
and let's see if this works or not if you get any either basically 403 forbidden information that means
it is not valid or you can resist the information or you to read Erickson is not valid to this link
with this payload and if you get some information like 404 that means page is not found but if you see
some redirection that means this payload is working so you can just try some of these payload and these
are good payload example for the open redirect with the pad fragment.
So now let's see if for another thing so let me just go over here and let me source for something like
Twitter.
So as I said Twitter and this Twitter log into Twitter.
So if I just copy these links so if I see a copy link location open my Sublime Text and if I just paste
here then you could see the link it starts with Google dot com but this is the actual link for the Twitter
dot com.
So if I just copy all of this.
So now if I just copy all of these.
So let me just copy this and go over here for the new user which is basically this private window if
I just pasted down here then you could see this link always is attached to the Google dot com.
So it has a Google dot com.
So that user won't get suspicious.
It was a see that this the Google dot com.
If I just said inter
it will be related to Twitter dot com.
So you can see that you can also make use of these some links to just make a user to have a you read
Erickson.
So instead of Twitter you can just inject your MLSE website over here.
So this is the way to see for the path fragment.
You can simply put some of these payload so you can just download this from the resource section or
you can simply go on the Google and search for that you see which is simply bug bounty to see it and
you can simply source for the redirect.
And now we can also make a use of it into the to those to give multiple below.
So you can simply drive this bill or you can simply this copy these and this entire at the end of this
payload.
But if you have multiple payload.
So if you have a list of a payload.
So if you have use bar suit in the case of exercise attack.
There was a functionality called the intruder.
So intruder is normally the way to just inject multiple payload leads to the you are a little basically
to see if that works or not if the payload works or not.
So you can see we have the only.
Here are the nine or 10 payload.
This is okay if you want to this inject one by one but if you have a bunch of a payload like you.
So I have.
Okay not here okay.
It is over here so you could see we have uh 462 a line of four lines are basically it has those payloads
over here.
So it is impossible for you now to just copy one by one and just inserted the end of this link.
So instead we can just make use of a barf suit to do that.
So we'll also stick to this website to test for this website.
So now first of all makes you or your proxies on.
So I'll just go to Dobson's I'll go to the settings and makes you dismantle proxy configuration is ticked.
And after that this is was said that we want to attack.
Let's see in the buzzers Obama's suit is disappoint over here so I'll just pass something at the end.
So I'll say we are taking for X okay.
This is open so I'll say at the end as the spots open it can be any parameter at the end because we
want to inspect.
So if you remember we want to inject this payload at the end of this are basically you at all.
So as we did with these several we want to inject all of these payload at the end in this open field
that means you can also give anything over here you can just simply give test.
You can also give your name and you can simply inject this payload in this search in field so I'll just
stick with this open because this is open you added with Erickson.
So if I just go about here makes your intercept design and go back to let me close this one.
So we are now just press enter to this bill and go to the bath salts above.
So this getting this get records so indicate because there is open.
So first of all all you need to do is send this to the intruder and in the intruder in the position
tab he will just get this open.
So make sure you just get all of these open selected and first of all you should simply clear all the
field.
So let me clear.
And again select this open and simply press add over here.
So we are just adding other payload in this open field now.
So let's go to the payload so all you need to do is simply get all of this payload from the resource
section.
It will have this open redirect payload or DST or simply you can also so let me make my intercept off
now so you can simply source for open you are read Erickson payloads
and you'll get some link over here opening related payloads
and this is the payload text.
So simply open that and you'll just get this line of bellows over here.
So all you need to do is simply create new notepad or the text file and you'll simply copy all of this
which is the 460 some line of course or payload.
So copy all of those go back to this text file and just make sort of pasted over here.
So the zero all payload and use simply save this to the folder where you can access in the basket suit
and I have already stored is opened out the.
You can also give any name to this and you can simply save.
And I'm not going to do that because I've already saved the same file and you could see it is in my
desktop with the name of open.
So this is the same file.
So now is this go to the bar suit and we have already gone into this into the you can see the bodies
and we have decided to put this into this request or basically do this you are I'll get you a.
So now it's time to load those payload so payload name is open.
So let me just open this propeller and you could see it has 462 payload count so all you need to do
is simply see here the payload count and simply start the attack it will take some time.
Give me the time to this attack for all of these Spiller land and wait for it until it is processed
all of these build.
So it has successfully executed all the payload so you could see it took a minute for me so it has successfully
first launched this simple payload which is empty pillar and yet it 400 for a status quo that means
nothing was foreign.
So if you just remember at the beginning of the lecture I have to let if you get any of the status quo
that begins with three that can be three and any caught up to that it can be 3x X so excesses stand
for any code so you could see we have a bunch of those scores so you could see here 3 or 1 so any after
3 is valid so we'll just see for this one.
So if I just see the response to the browser let me just click this one copy this and let's see if this
works or not.
So I'll just go to the Mozilla.
And let me just paste and go and it is not giving a read Erickson.
I was received this is Dano for.
So it is mental policy.
So OK.
It is not working.
See why.
So it is not working let's see for another domain.
So let's see for this one
should be starting with 3 0 1.
So let's see for this one
so.
This is 4 billion this is not allowed.
So you could see that we can this test a d of the field so we can simply go with this one so response
in the browser.
Copy this one so you can simply paste it right here.
So after users paste you'll see that it has injected some of the payload right here and we saw in the
b roll selector that it is only valid.
That is this bill or this one payload which was only valid to this case.
So let's see if that payload was here or not.
So it should be somewhere over here so we can simply add your manual payload if you want I'm just searching
for the the simple this one.
So it is encoded over here.
So let's see.
Let's take it out some real quick so let's see for this one so let's see.
So we have already got this and it was not valid.
So let's see for this one so send.
So response to the browser was going over here.
Let me pass it over here.
So if the space is down it is giving us a lot of a local domain dot BW because this was a payload that
was going to this give some local domain so local domain dot pedo Lou has this alert that means basically
we have a you add a lead Ericsson so instead of going to this original website it had us redirect to
this local domain node BW So instead of local bid this domain are local domain dot BW You can simply
inject something like Okay.
So I'll say it can be Google.
So you can just change here or basically you can change in the payload.
So instead of local domain you can simply go to the Google dot com and it will have the reseller Ltd
Ericsson to these selling.
So you can see we have an alert saying local domain dot pedo Lou.
So that means you have a you are a leader Ericsson that you make use of whole of this payload to see
if there is you are a lead Ericsson or not in this list.
So instead of this you can simply let me just add one real quick over here.
So I'll just say Google dot com.
So if I just add this and now it has for sixty three.
Well let me just start to tag again.
So do this take a time again.
So I'll just pause for a moment until it finish and I'll just come in a moment.
Now it has successfully finished all of these payloads so it has injected all of this pillar.
But we wanted this pillar so you could see it has its status scored of 301 if it was of 404.
That means we wouldn't see this payload even but it has a response of 301 that means it has a you add
a redirection.
Is lent is small.
Well let's see the response in the browser and we always see response over here.
So I'll just quickly paste and go dissembling so let me just copy it one more time dissembling.
So it should be right here.
So I'll just say so this once in the browser open the link and paste and go.
So when it is best and the first page then you could see it has the Eric to Google dot com.
That means it was valid and we have it this year with this custom payload that we this inject a little
bit here which was this flawed and just making over here so you can also paste with the manually over
here and you could see the same redirects and instead of Google it can be your malicious Web site so
you can also make a use of an intruder to load multiple payload.
You can also see that we have a multiple payload over here.
You could just see which of these works.
So if users get any request that it starts with three hundred and basically it is valid.
So if you see 404 that means it is not valid.
So you sooner just simply copy this and basically it is useless to see the response in the browser because
it has 404.
That means it is not valid.
This is status code is not found anything or basically it is not having the other read Alex and so it
was a source for the code that is 301 and we'll just see this once in the browser.
Some of this will work and some of those aren't.
But it is basically what happens in the bug hunting.
So this is the way to work with the open redirect through the path fragment.
So in the next lecture will the see for the another technique that is this passing are just facing these
idle parameters and this custom lead is passing the target to you URL to those barometers.
So that will be covered in the next letter but in this letter we just simply saw how we can just make
you use a path fragment to inject the payload to the intruder and through manually and see the open
you are a lead Alex and so you can just simply copy or basically download this usage from the source
6 and in this you can start applying those or to the target or sites or the lie Web site.
So soon the next one.