In this lecture,
we're gonna continue testing the loader.php file
with the f parameter, and we're gonna see
if we can discover any other vulnerabilities
or if it can point us towards other bugs or vulnerabilities.
So, so far, we know that we can originally,
this used to say reviews.php,
and it just loaded the reviews,
and then we saw by sending the admin,
we were able to be pointed in a direction
where we were able to log in as admin.
Now, again, as a bug hunter or as a hacker,
you should ask yourself
what other values can I set the f in here to?
You can simply use the intruder, as I showed you earlier,
and set the S's in here after the f,
and test for a large number of words,
and just have it automatically send these words for you.
But before doing that, and before you start guessing,
let's see if the code and the data used
in the target website can point us to the values
that we can use in here.
And to do that, again, we're gonna use the target,
and we're gonna use the filter functionality in here.
Similar to what we did in the previous lecture.
And instead of looking for adToken,
we're simply gonna look for f is equal to whatever.
So we're gonna see if any of the code
that that is used on the website
can give us any clues of what values we can set the f to.
So we're gonna click on Apply
and as you can see, we're already getting a lot of results.
So you're gonna have to go through them one by one.
So in here, you can see that f is equal.
We have one match and it's equal to admin,
and that's something we've already tested.
So that's not interesting.
And here again, we have two matches.
That's the first one.
And that's the second one.
Just the admin.
And similar in here,
this is actually looking for the adToken,
so if we look for f is equal, these are just hrefs.
So they're just normal links on the website,
they're not really pointing us towards any endpoints
or any useful values.
Go into the next one, the custom-script.JavaScript,
which sounds like it's promising
because it's some JavaScript in there.
If we look for the first occurrence,
you can see it's just pointing us to some code.
We'll get back to this later anyway.
So we're gonna look to the second one
and again, it's just a href giving us some code.
So it's nothing useful again.
So we're gonna go to the next one.
Hopefully this one is promising.
So again, we're not really getting anything useful in here
until we get to this line.
And this is actually very, very useful
'cause as you can see,
it's actually saying f is equal
to /generate-credentials.
So if we manage to send this and if this actually works,
we might be able to generate some kind
of credentials to log into the website.
So we're gonna copy this.
And we're gonna go back to our repeater.
And instead of admin,
we're gonna say generate-credentials.
We're gonna send it.
And perfect, as you can see, we actually got a response
with a username, and a password.
So I can actually just copy this,
and paste it in my notes.
So data found.
And we're gonna be able to log into this website hopefully
with this username and this password.
So as you can see by simply just paying more attention
to our parameters,
and searching through all of the data that we have,
we were able to get a username and a password
that'll allow us to log in to this website.
And then once we log in,
that's obviously gonna expose more features
and hopefully we will be able to discover even more bugs
and vulnerabilities in this website.