Hello, everyone, and welcome to this video.
So while performing penetration testing for Target Organization, we are able to identify one of the
broken link into the Web application.
So, as you can see, this is a live target, which is your toes, dot com.
And under this target web application, we identified that one of the link was pointing to another service,
but actually never was existing or was never claimed.
All right.
So let's see this how we are able to identify this.
So we clicked on one of the users page and redirected to the LinkedIn profile, as we can see over here
now.
Unfortunately, this LinkedIn profile does not exist or the profile is not available.
So now what the attacker is going to do is attacker is going to create a LinkedIn profile with the same
user name, which was pointing to LinkedIn from the target of application, which is your post dot com.
All right.
So as you can see, I have created account with the name Goodman.
So I'm just going to quickly go into the settings to identify where I can change my public, you all,
and take over the target.
You are of the target web application.
So let me just navigate to edit my public profile.
And you can see on the right hand side, this is my old profile, which is good man.
And now I'm willing to copy this you all and pasted over here.
So, yeah, I have done this.
Let me just save this and you can see success.
We have updated your settings.
I have successfully claimed the new you all.
So let me again click on the you all as again, see, this person works in the operations.
All right.
So now any attacker can impersonate this employee, which is working in operations and try to communicate
with other users or communicate with the people who are working on this website.
And this way it can be a loss to the target company or organization.
So I hope you guys understood this.
Thank you.