Original subtitles

So let's take our training site.

This page says, welcome to my website, have you seen my new Web site called Google dot com?

If we click it, it's just going to give us a clue what outcome?

We don't see anything in the back.

But if we're right, click copy link and paste it.

We can see that this site is using a redirect parameter and whatever value opinion here is more than

likely going to be used to redirect the user.

So, for example, if I put in here Lahham Secombe, we're going to get redirected the namesake without

any problems.

This is very, very common in Buckman's after this happened.

A lot of times you just have to be very good at seeing these different parameters and fuzzing get to

a point where it gets redirected to your website.

If you remember the earlier chapters that we talked about, response codes, as I type in redirect on

our website right here, we're sending a request to Nahoum Technical Training Redirect in the hopes

that the outcome with the request method being set to get we're getting it three or two.

This is important because it tells us, hey, there's an open redirect order.

Actually, there's a redirect happening here to look for it further.

It's always good to know the status goes and understanding what each one means.

Just another is clicked.

The application is going to redirect us and we can either have a fishing page, a fake login page or

whatever else right here in order to exploit our users.

And also, I mentioned that it's always not that straightforward.

So in this case, again, for another example, if we click the link, it's kind of a Google dot com

again that's tried again and go to Google NORCOM.

Now I'm going to swap out Google with knapsack.

And this is a website that it's not trusted by the Web server.

So it says, hey, it's not allowed to this host because I don't recognize that the name is spelled

no homosexual.

Try it again.

It says, hey, it's not allowed.

I don't recognize this, but now we have to figure out, OK, what is this application really looking

for that for Google dot com right here.

Obviously, it works.

Doesn't work, is it?

That's what dub dub, dub, dub, dub dub, Google dot com that works.

What if I put the homosexual dot com.

That doesn't work.

So we start to play with it a little bit and see what things do work and what doesn't.

So we're going to do it again.

The homosex dot com that also isn't allowed, but there is a functionality in every browser.

So if you actually type in a valid domain like Google dot com at a domain you want to actually direct

with outside like that, that's actually a browser functionality.

This would work.

So if you do this, the user would get redirected to the website on the second hand.

So whatever you put here is going to be what the user gets redirected to.

So I put Yahoo!

Dot com, whatever I put in here, dot com doesn't matter, gets ignored and we get redirected in the

dot com instead.

Now let's see if that trick works.

So we're going to go back into our training site and we're going to swap out this right here with Google

dot com.

And we're going to tell you to bypass that and completely ignore this Google Larcombe or whatever we

have in here and using the Hopsin at the end.

And we're going to fit that into the application.

And as you can see, this actually redirects the user to Nozick dot com.