So this is exactly how hackers create what we call phishing website or fake Web site.
And once you clicked on it because you tend to go to the website, you log into the website, it will
make your account do funny stuff.
So over here on the left side of colonics running and what I can do now is to go ahead and open up,
see any browser's in case we open up Firefox.
So once I've opened up Firefox, enter the IP address or the domain name that we were targeting as a
website.
So in this case, we have one or two one six eight zero one five six.
And of course we have Port eight zero eight zero SWEPCO slash login.
So let's go ahead and log into the website.
So you have not yet registered into this website.
Go ahead and register that.
So we have already done the registration so we can enter the user name and of course we can enter the
password and we can go and login right into Webcke.
It's a Web code, is a vulnerable Web application system for us to run all our article hacking techniques.
And I remember hacking is illegal.
If you want to hack, run it inside your own lab environment and on the bottom left so we can look and
request forgeries.
So let's go ahead and click on a cross site.
Request forgery.
So Crosseyed request forgery is actually very easy to understand.
So as you can see here, we have a link.
So this is a hyperlink, a nature Reserve Bank dotcom slash transfer account number.
All right.
And of course, we can see over here account number from an account number two and an amount.
All right.
So this is what you typically see under the U.
Or L as you input different actions into, say, an e-commerce site to at a product.
All right.
If you want to do a look up of your account profile, you'll be able to see see, for example, your
account ID and all those different information, integral and of course, do.
What's the and you see the falling view, my pictures.
So what are the hackers trying to do here is to trick you into clicking the link.
And because you already log in to the website and because you really log into the website, it will
make your account.
Do those actions that a hacker wanted to do in this case, for example, it is account number from account
number two and of course, an amount out of your bank account.
So in lesson number four, poster review on someone else's behalf.
As you can see right here at the bottom, we have John Doe is selling this particular poster, read
reviews below.
And we can see here Lilling Five Stars Hacked by Lioy.
This is an awesome tutorial.
And so on, so forth.
So we can see the username and we can see as well as the review.
And of course you can input a star.
So what we can do now is to do a right click inspect element to look at the form.
So this is the part what we'll be learning about how we can send information on behalf of the user so
we can do it right.
Click and then as XHTML.
Right.
And you can select everything and I can do it right.
Click and copy it.
So now we will open up a text editor.
So in this case we can use mouse pad and go ahead and open it up and we can pace the form that we have
just copied over here and it can save it into home.
Or in this case, I'll call RF, highjacked it dot hakes html.
Of course I can go in and click save.
All right.
And we placed a fall that I was testing earlier.
So now we have to form.
All right.
And we can see over here with input from control and so on and so forth, so we can go ahead and get
rid of a class.
So in case they're using certain controls and a JavaScript and so and so forth, so we can go in and
removed all those.
And here we have the ID.
So we'll leave the ID as it is because this information will be sent over into the application server
for processing.
Next, we have a name.
All right.
So likewise, it could be use or in this case, we also have placeholder at the review so we can easily
change up the placeholder.
And we can enter, say, for example, hacked by Lioy, OK, and we have to type equal tax.
And of course, all you going to do right now is go ahead and open up this file that we have just created
so I can enter.
Right.
In this case we can just go hand or Firefox followed by SRF highjacked that e-mail hit enter a desk
and he opens up a new tab.
And we can see right here we have a new form, a newly created form by us, hosted in our local computer.
All right.
And whoever some ID from here will be able to send all those details, all the information to commands
to start the rating and all these different details from our local computer all the way into Web application
system.
So how can we bring this to the next level?
What we can do now is to go ahead and change the information here.
So instead of using a tax which will be shown to the user, we can change the type to hidden and mix
up.
We can enter the value on behalf of the user.
In this case, we can enter, say you review tax, the review takes, we can see a hacker ly is awesome.
I will want to subscribe to the channel.
Subscribe to the channel.
And turn on notification right now.
OK, so again, this is a really, really good, fantastic review.
Of course, we have here review stories in this case like why?
So we can change this to Hayden and we can enter value on behalf of the user.
So I can enter five.
This is five star rating.
OK, Fantastic Four Stars.
All right.
This is a perfect review.
And what we can do now is right before an input.
I can enter the following, OK, right before to some in button.
I can enter the following.
I can enter click this submit button.
You get your hundred dollar vulture's now.
OK, so once we save it I go back to the page, refresh it and we can see right here click to submit
button to get you one hundred dollars Volke right now.
So one last thing that we need to confirm is the action.
So this is where we'll be posting into so I can enter TDP, BaLobedu, Iapetus one or two one six eight
zero two one five six.
Follow my PT. eight zero eight zero slash Rabu ref review.
All right.
So this summit button to get you one hundred all vulture's now.
So once we have said this for it, I can go in and refresh this, OK?
And once I click on the review, if you see carefully in three to one, I clicked on it.
That's it.
Lesson completed.
True.
It appears you submitted correctly from another site.
Go reload and see if your post is there.
So what do we just do before a review?
And now if I do a refresh, I close the web developer.
I do a refresh.
All right.
I go to request for Tree Cross site request forgery.
Click on lesson four.
I scroll down and you can see right here, Hackle Loy's awesome.
I will want to subscribe to the channel internal notification right now.
OK, so very quickly, we're able to create a fake HTML page and we can send it to anybody and once
they click on it, that's in our will be able to trick them into clicking this button and it'll be one
hundred dollars value.
But once they click done, it will be able to do all sorts of instruction and commands into your account.
All right.
So how can we bring this to the next level?
What we can do now is to go ahead and start up our application server.
All right.
So we can enter a Web application server, can enter a pseudo system, ctrl start aperture.
All right.
To dot service and enter and that enter your password.
So now Estado Apache's server.
So what we can do is to go in and transfer to file over into overwrote doped up.
All right.
So as you can see here, we have a lot of pages that we've created for you to learn all about radical
hacking.
And of course, here we have the CSS, RF Highjacked Advantage HTML.
So we go ahead and transfer it at file.
So copy the file or you can copy, you can do a move.
Whichever is your favorite choice by XHTML hit Enter on debt.
All right.
Permission denied.
No worries.
Use super super user do hit enter on debt.
So we have transferred the false SRF highjacked not a.T.M of copying it over into via HTML.
So right here we have the fall and we also have our IP address of a colonics machine.
So all I going to do now is to go ahead and open up the site and we can enter IP address so we can all
call the IP address of one or two one six eight nine zero one zero six.
I go back to the browser.
I entered a website link one two one six zero zero one zero six four by slash and we can parcelling
right here see RF highjacked XHTML and that's it.
We hosted our fishing website and all you going to do if you want to put it onto the Internet is to
actually enable port forwarding.
And what hackers would do is to people upload all this different kind of fake documents into different
kind of cloud providers.
So a lot of cloud providers give free travel and hackers.
What they would do is they would take advantage of those free trials, create all this phishing sites.
Once you click on it, you'll do up a Bitly link.
I it's a shortened ling, a shortened form.
You clicked on it.
That's it.
Game over.
But you have to verify who are sending you all those links.
And if they are malicious intent, you've no idea who they are.
Delete away those messages.
The once again I hope you learned something valuable in today's tutorial.
If I have any questions before you leave a comment below, I'll try my best to answer any of your questions.
Like Schantz, let's cut the channel so that you can be kept abreast of the latest cybersecurity tutorial.
Thanks so much once again for watching.