1

00:00:01,000 --> 00:00:02,450

Yes, so hello, everyone.



2

00:00:02,980 --> 00:00:09,520

So in this video, we are going to see one of the very interesting example of how a security researcher



3

00:00:09,520 --> 00:00:15,400

was able to identify a broken link, highjacking into a company's LinkedIn page.



4

00:00:15,910 --> 00:00:22,440

And through this vulnerability, when he was able to identify, he reported the vulnerability and got



5

00:00:22,450 --> 00:00:24,880

a reward of five hundred dollars.



6

00:00:25,330 --> 00:00:28,320

So let's quickly see how he was able to identify.



7

00:00:28,360 --> 00:00:35,080

And then we are going to see the same proof of concept to identify a broken link hijacking on a company's



8

00:00:35,080 --> 00:00:35,980

LinkedIn page.



9

00:00:36,220 --> 00:00:36,600

All right.



10

00:00:37,030 --> 00:00:41,290

So a very good resource, which is at all flew a brokenly hijacking.



11

00:00:41,300 --> 00:00:45,010

We are going to discuss it in the next couple of videos.



12

00:00:45,820 --> 00:00:53,560

So he used to, which is B and C, we are also going to see how you can use this tool to identify broken



13

00:00:53,560 --> 00:00:56,550

links on any target of an application.



14

00:00:56,560 --> 00:00:59,410

But before that, let's see this interesting thing.



15

00:00:59,900 --> 00:01:00,550

Brilliancy.



16

00:01:00,550 --> 00:01:05,620

See, the URL is the Blue Dot Lingnan slash company and the company name.



17

00:01:05,630 --> 00:01:08,800

So the researcher was able to identify this.



18

00:01:08,800 --> 00:01:15,010

You are with the company name and the response to that was four zero four not found.



19

00:01:15,670 --> 00:01:21,880

OK, so the next step was to create a company page with the above company name, which was actually



20

00:01:21,880 --> 00:01:25,950

not available or was not of any time published.



21

00:01:26,650 --> 00:01:29,290

So you made the company name in the above.



22

00:01:29,290 --> 00:01:31,660

You are headed to Khordad.



23

00:01:32,410 --> 00:01:39,070

So now, as I hope you guys have understood as there is a link page of the company, when I the user



24

00:01:39,070 --> 00:01:43,540

clicks on the link, he will be taken to the hacker controlled LinkedIn page.



25

00:01:43,810 --> 00:01:44,250

All right.



26

00:01:44,530 --> 00:01:51,130

So this way, any messages or any communication or queries that has been sent to the LinkedIn page will



27

00:01:51,130 --> 00:01:53,220

be sent to the attackers control.



28

00:01:53,590 --> 00:02:01,820

And this way, the attacker can also create a business loss or reputation loss for the target organization.



29

00:02:02,230 --> 00:02:08,910

So let's see a quick bucy or a proof of concept of this vulnerability.



30

00:02:10,120 --> 00:02:13,540

As you can see over here, the web application is broken.



31

00:02:13,540 --> 00:02:14,780

Borders are secure.



32

00:02:14,800 --> 00:02:16,530

That files within.



33

00:02:16,540 --> 00:02:20,990

There is a broken link onto this target website.



34

00:02:21,160 --> 00:02:22,810

So where is the broken link?



35

00:02:23,020 --> 00:02:27,210

I have simulated the exact same scenario.



36

00:02:27,220 --> 00:02:34,510

And when you click on the link, so let me click on the link and you will be able to see that it is



37

00:02:34,810 --> 00:02:35,380

available.



38

00:02:35,560 --> 00:02:42,430

Can you see the profile is and available, which means there is no account on LinkedIn that has been



39

00:02:42,430 --> 00:02:44,470

created with LinkedIn.



40

00:02:44,860 --> 00:02:53,110

The same you all and you can see what was the profile in the profile name is if you look closely on



41

00:02:53,110 --> 00:02:55,020

the left bottom over here.



42

00:02:56,170 --> 00:02:57,850

Let me take over there and it is.



43

00:02:57,850 --> 00:02:59,260

Take me over please.



44

00:02:59,300 --> 00:02:59,700

All right.



45

00:02:59,710 --> 00:03:06,700

So now we are going to take over the account that I have just signed up on LinkedIn and I have created



46

00:03:06,700 --> 00:03:07,280

account.



47

00:03:07,300 --> 00:03:12,710

So let me just finish the steps and then we are going to take over the LinkedIn profile.



48

00:03:13,330 --> 00:03:17,710

So let me quickly put these details on next.



49

00:03:19,670 --> 00:03:21,110

OK, so let's say student.



50

00:03:24,680 --> 00:03:27,260

OK, so let's say.



51

00:03:28,690 --> 00:03:30,220

Google, for instance.



52

00:03:34,440 --> 00:03:36,370

OK, so are you looking for a new job?



53

00:03:36,470 --> 00:03:37,050

Not now.



54

00:03:37,780 --> 00:03:39,390

Let's quickly skip this.



55

00:03:42,190 --> 00:03:47,230

OK, so let's skip this as well, let's skip this as well and.



56

00:03:49,070 --> 00:03:50,130

Let's finish this.



57

00:03:50,420 --> 00:03:57,370

All right, so you can see we're now we have successfully created our account and perfect.



58

00:03:58,280 --> 00:04:05,080

Let's go on to our second speech quickly and click on View Profile, as you can see when I click on



59

00:04:05,090 --> 00:04:05,850

your profile.



60

00:04:05,900 --> 00:04:09,080

This is my profile link with this hacker.



61

00:04:09,770 --> 00:04:14,150

Hyphen me hyphen Dubberly seven seven two zero one me.



62

00:04:14,180 --> 00:04:20,350

So I need to change this rate because I want a new order for myself.



63

00:04:20,360 --> 00:04:25,480

So for that I need to go into the settings and I need to change my public.



64

00:04:25,490 --> 00:04:31,430

You are in so let me go in settings and let me see my public.



65

00:04:31,430 --> 00:04:32,150

You are ok.



66

00:04:32,210 --> 00:04:33,470

So it should be in.



67

00:04:35,450 --> 00:04:44,360

Yeah, so I am able to edit this profile, you also just had to edit contact info and when I click on



68

00:04:44,360 --> 00:04:48,580

this, I will be redirected to edit my public profile.



69

00:04:48,990 --> 00:04:49,360

All right.



70

00:04:49,460 --> 00:04:57,410

So you can see on the right hand side and your custom, you are also going to edit this to take me over,



71

00:04:58,040 --> 00:04:59,720

please, and see if this.



72

00:05:00,550 --> 00:05:02,670

And you can see success perfect.



73

00:05:03,190 --> 00:05:05,200

Now let's see if we are able to take over this.



74

00:05:05,210 --> 00:05:09,550

So let me just reload this again and click on the link in one.



75

00:05:10,060 --> 00:05:17,350

So once I click on Lyndy and you can see we have successfully taken over the LinkedIn profile of the



76

00:05:17,350 --> 00:05:25,510

Target organization and now the malicious content will be solved using this profile, which is hacker.



77

00:05:25,510 --> 00:05:31,830

You mean that we have recently created and this is the attacker controlled domain.



78

00:05:32,290 --> 00:05:34,930

So I hope you guys understood how you can do this.



79

00:05:35,080 --> 00:05:35,650

Thank you.