Now let's see.
Open you a lead Eriksen through barometers index and so here we have the redirect payloads that we just
did in the previous lecture.
So these are the payloads that has the pod fragments to simply we just injected this payload at the
end of the year to see if it has opened up a lead Erickson or not.
So this was the one payload but now we don't want this with this one to see the parameters.
So it should be inside the You are also the source for some of these barometer like you had all written
neural next are basically neural.
And again it has only the euro you can see for the redirect you can see out.
You can also see for view and everything so you can see for this logging too so will now go to this
Web site and less.
I've already started to this Crawly sort of set and I just got a few of these barometers.
You can see the method over here barometers and the stethoscope and the land.
So I was sorted out and if you see here that in this link over here this is the get method and this
is the link.
So this link has the account log in and the data return you are.
So I've already said in the previous couple of lectures that anything that starts with this question
mark is a barometer.
And if the parameters is something like return you are all are you at all are pays.
And something like that.
That means it is just redirecting to somewhere.
So what is the source for the new redirection and so in order to do that you have to first send this
to the repeater so I'll just send this to the repeater and just go over here.
This return you URL.
And now I'll just eat it to the being dot com or maybe something else.
So let me say a CTP being dot com.
So this is uh the way so.
Let me just quote a response and see if this works or not.
So I think this is not working but let's see.
Let's go over here.
Less space is down and it is not working so it is saying that it is not redirecting us to being dot
com.
Is this is also the and you are.
But this is not redirecting.
So let's see what happened over here.
So instead of return you are a what you can do is simply you can put something like this and you can
simply send this to the intruder.
Go to the intruder and go to the partisans.
Let me clear all of this what is enforced.
And let me say let this test ad here the payload.
So let me just Lord the open payload that is is loading the previous Lexus or simply let me just start
the attack
it is working.
So let me just wait for a moment.
It is working with us some of these all the payload which is for 62 payloads so meanwhile you can see
we have this the return you earlier which was a dumb you all are basically the parameters of this you
are all where you can inject this pillar so it can be something like you are really if you have something
like you are all you can also have something like view if you just get any parameters like this then
you can simply see by injecting some other website and see if this works or not.
So in this case we have a written year.
So let's go to the box that again and it has finished.
So let's first of all make a descending order of this land see if this is working or not so this is
a response in the browser at best and go and it is not working it is not redirecting to anywhere that
means this return to a real parameter is not wonderful so you can just simply see for the another payload
to but and waiting in the wasting for any time so you can see that we have a quite even.
So you can source for the query but instead of query I just go for another Web sites.
So I'll just go for this Web site so you can see we have this Web site so platform innovation because
this Web site is not having open you at all redirects and vulnerabilities or we just close this Web
site.
Now it's time to check for this Web site.
So I have already Spider this Horst and I have here that is added to this group.
So we have a bunch of you earlier so you can see the return to you are a little over here.
So return to URL is also the barometer that will just give you added Ericsson so let's see if this does
or not.
So you can simply send this to the repeater go to the repeater and instead of this Emmanuel pace I'll
simply say as GDP give the column and also Google dot com let me just please go and so response in the
browser.
Let's see if this works or not.
So I just spaced it down here.
And let me just close this and say let's see what happens.
So it has related to Google dot com.
So if you see over here.
So it was something that the return to was taking us somewhere.
Let me just go to the target and it was taking us to the index dot B as you file so in instead of index
dot be as we now we have injected our you l.
So when as I said try again.
And if I screwed this sine buttons.
So this is essential because if you this close this one then only it is redirecting so if I just say
index or something like index dot PSP
and if I just close this one then it is only redirecting to index dot BSP now you'll just get the one
page of Nokia innovation.
So that means it has a you are read Eriksen through this return to so you can simply check for D of
this field so it has also the side.
So this is not going to give us a you are all read Ericsson.
You have to source for some of these fields like return to and basically region you are ill or something
like that.
So this will be the Lexus or you can see that another barometer over here.
So let me just try this one.
So if I simply first of all I need to send to the repeater so I think this is not going to work even
because we have seen for the logging it was not working already so it is not a good way to see for this
one.
So you can source for the excesses attack instead of this you are a leader Ericsson you can simply put
your own burial but so text or strings over here and check if this is showing any reputation and the
repeater by seeing the response and if it is then you can simply thus put the payload from the intruder
the list of the payload which can be basically they access its payload and you can simply see if that
payload works or not.
So this is the way to work with you at to read Ericsson.
So we'll see more of these example in the upcoming lecture.
So see you in the next one.