Original subtitles

okay guys uh this is the first demo in

this course and

what i'm going to show you is forgot

password functionality so i've got

a testing web application here and let's

assume that i have forgotten

my my password so i'm going to use

forgot

password functionality i'm going to put

my

email here david at example.com

right this is my email and i just want

to to receive

a password reset link right so let me

click this and you see that password

reset link has been sent to your email

okay that's cool let me go to my mailbox

right now i'm going to

log in and

see you will see that indeed i have

received the password reset link yes

indeed it is here and and

yeah the password reset link actually is

here

right so it's inside of the email

so now i'm going to click this password

reset link and i'm going to show you

how this automatic leakage of password

reset link

can happen so let me click it

and this is what i see so i'm actually

as you can see

i am asked to enter a new password right

so it works as intended but now the

question is

whether there is some kind of data that

is loaded from external domain

and i'm going to show you how you can

easily use

dev tools to find out if a given for

example image

is loaded from external domain or not

how you can do it

quickly so um basically what we've got

right now we've got password reset link

in the url bar please take a look out

there

we are asked to enter a new password and

now we've got some

kind of image here we've got some kind

of image here right

so let me use dev tools and dev tools

are

built into the browser so i can easily

use them to

you know to quickly learn something

about the web application

right now i'm going to open dev

tools and i will use the inspector in

depth tools

because when i've got inspector i can

move my mouse over a given element

and i can just see the underlying

html right and what you can see here is

that this image is loaded from domain

silesiassecuritylab.com and yeah so

this kind of attack leakage of password

reset link

should happen in this web app right

because we've got password reset link in

the url

and this image has been actually loaded

from

external domain right my application my

testing web application is hosted on the

domain example.com

the image is loaded from

silesiassecuritylab.com so we've got

two different domains cool so this

problem

should happen and now i'm gonna show you

how you can check

on your own if this problem happens in

the web application or not

so what i'm going to do right now is i'm

going to go to the network

tab right now in the dev tools you've

got also the network tab

and network tab is really cool because

in the

network tab you can just

see the outgoing requests from the

browser

and this is exactly what i want to do so

i want to

reload this web page so this is like

clicking the password reset link again

from the mailbox

i'm going to reload it and i'm going to

observe the outgoing

request from the browser so let me do it

and that's why i'm using

network tab in the devtools so let me

reload it

right and cool you see that

for requests have been sent

free requests to domain example.com

and the one request to domain

silesiasecuritylab.com

and this is this is the request that was

sent to fetchimage.png from this domain

so let me now click this request and see

the details right

because i want to show you the referrer

header out there

let me make it a little bit bigger right

now

and yeah this request let me go down and

i want to show you

the request headers so as you can see

here

the host is silesecuritylab.com

and now let me show you the refer header

can you see that what we've got in the

refer header is the password reset link

example.com reset dot php

question mark token and the value of my

password reset token

so my password reset token

my password reset link has been

automatically disclosed

to the external domain at the time of

fetching the

image from the external domain this is

how it works

now i believe that this is clear and now

you also know how you can

check if this problem exists in in the

web application so you can go

take your program take the web

application and now just

follow the steps and so you can find out

whether this problem

uh happens uh or not so this is how it

works you see that this is

a a really severe problem and

yeah very nice uh very nice bug this is

basically it in in this demo i believe

that everything is clear

i i hope that you like it so let me

right now

jump to the second bug from our list