As mentioned previously,
testing every single visible functionality
and pressing every visible button
does not guarantee that you covered everything
and you tested everything.
And we saw how we could actually analyze the code in here,
and use RegEx to actually discover endpoints
that we've never seen before
that are buried and hidden within the code.
So in this lecture, I wanna continue on that idea
of trying to discover hidden features
and hopefully hidden endpoints and parameters
so that we can test them and hopefully discover more bugs.
To do that, in this lecture,
we're actually gonna rely
on a Chrome extension called LazySec.
Three is another one called Unhide.
There is actually a lot of these extensions,
and basically, once you have it installed,
and installing it is very easy,
just click on Add to Chrome,
you will have it in here,
and once you have it in here,
you can go to the target website,
and click it and hopefully,
it will display some useful elements
or useful links or useful input boxes
that you can test and hopefully they're vulnerable
and therefore, help you discover a bug.
So let's have a quick example here in the Home page.
We're gonna click on the extension in here,
and it's asking you what exactly do you want to display?
We're gonna say I want you to show me all
of the hidden elements.
So we're clicking on All,
and we're gonna say Show Hidden Elements.
And at first glance, it doesn't seem
like it actually displayed any hidden elements.
But if you click on the login,
you'll actually see that it's actually highlighting
the hidden elements for us in red right here.
So there are two new elements that we've never seen before,
and we actually saw this one before
when we clicked on Request Account
but we never saw this element before.
And this is actually a link.
So if you hover over it, it is a link.
But if you click it, you're not gonna go anywhere.
But still very interesting
because this was hidden.
So it must be hidden for a reason.
And therefore, I'm gonna right click it
and inspect it so that I can analyze this further
and see what's the point of this button,
and hopefully understand what it's supposed to do
and then maybe discover a bug in it.
Now, we can see that this is a link
because it's using an a tag with an href,
which is usually what specifies the link
but you can see that there is not a valid link in here.
You can also see that there is an id
and this is the value of the ID.
Now, IDs are usually used in HTML
in order to identify an element, hence the name,
and then JavaScript a lot of the time
would manipulate this element using its ID.
So once you see an ID,
it's actually worth a good try
to go back to Burp and look within the JavaScript files
that you have in here,
and see if there's any reference to this ID
because normal HTML could contain JavaScript,
and see if there is any reference to this element.
And that's what we're gonna do.
But before doing that,
I actually usually still just give it a go in here,
put a question mark,
put the ID and then try a few things.
So try to because it's saying redirectUrl,
I'm gonna just try to redirect it to Google.
So we're gonna just do google.com.
And you will notice that that doesn't work
and I might actually play with this a little bit.
Maybe do your redirect_Url
and try a few things but you will notice,
none of that is gonna work.
I'm only doing this in here
just to show you how I would go about it
even though it's failing
but like I said, the fact that you see an ID in here,
it is more likely
that you'll actually find a reference to it
if you go ahead and search in the target
and in the filter in here.
So this time, we're not searching for a RegEx anymore.
We're searching for a normal text.
That's why we're gonna untick this box.
And then I'm gonna paste what I'm searching for,
which is redirectUrl
and I'm gonna click on Apply.
And once we do that,
as you can see, it's gonna list all of the files
that contain the redirectUrl,
and like I said, it's very likely
that it's being used in some JavaScript file,
so the .js in here, it means it's a JavaScript file
because programmers like to actually manipulate elements
using their ID so the fact that this has an ID
gives me a hint that it's actually being accessed
and manipulated somewhere using JavaScript code.
So anyway, we have the file in here,
and we can actually search for that we're looking for,
which is the redirectUrl,
and we actually have it in here.
And you can see that the redirectUrl
is actually equal to something
that is called urlParams.get.
Now, I know what this is
but assuming the first use of this for the first time
and you don't know what this is,
all you have to do is simply copy it,
go to Google, and search for it.
And you can see, the first result,
without even viewing it is actually useful.
It's telling you that the .get method in the URLSearchParam,
which is what we have in here
gives you the first value associated
with the given parameter.
And the given parameter in this case is from.
So basically, this is a way for JavaScript
to get values sent using a parameter called from.
So now we know that this page right here takes a parameter
that is called from.
So let's go ahead and test it.
Let's just go back in here,
and let's set the from parameter this time to google.com.
Now, you can set it to anything else you want
but we're just gonna leave it at Google.
We're gonna send it,
and right now, if we click on Login again,
you can see that the element is visible by itself.
We didn't actually have to unhide it
but you can always unhide it using the same way.
And we're just gonna inspect it
to see what happened to this element
because we know that it's being manipulated
using this JavaScript,
using the from, and we sent the from.
And as you can see now,
the value of the href has changed.
It used to be a hash,
but now it actually has the value of the input
that we placed in here.
So right now, if we click on this link,
we will actually go to the value that was in the href,
which is google.com.
And this means that we have discovered
an open redirect vulnerability
because we managed to get this website to take the user
to another website that they're not supposed to go to,
and this way we can actually inject
a malicious website in here
that contains malicious code
or a cloned website to this website
that will ask the user to log in
and then we'll be able to steal their information
and the list goes on.
So this is a very valid bug like we said
and you will definitely get a bounty for discovering it.
Also, you should keep in mind
whatever you're typing in here
is being injected in the href.
And as we said before,
you can actually inject JavaScript code directly
into the href without having to escape this,
without even having to complete this element.
So all we have to do is type javascript,
followed by the JavaScript that we want to run,
and we're just gonna do a simple alert.
We're gonna say three this time.
We're gonna hit Enter.
And let's click on Login.
Click the link and sure enough,
our JavaScript code gets executed,
so now we actually discovered two bugs.
We discovered an open redirect
and a reflected XSS vulnerability
and you should actually get bounties
for both of these bugs,
and we managed to do all of this using a hidden element
that we've never seen before,
and we were only able to see it
by relying on an extension,
similar to this one right here
that will display hidden elements for us.
We did better research based on everything
that we learned so far, and as you can see,
we ended up discovering two more bugs in the target website.