‫So B, Web handles different aspects of excess very well, and the next example is one of them.
‫So after logging into B Web, choose reflected Jason from the menu.
‫And there's a search box on the page.
‫So let's examine the page a little bit.
‫So I'm going to type t h o r into the box.
‫And yet we have that movie.
‫It's a positive result.
‫Now, what I type is also in the you are l the title parameter holds this value.
‫OK, so now let's view the source.
‫And here, as a result, the page sends Jason data.
‫And this data is parsed and printed to the page.
‫All right, you ready for another enter i r o n MRN without spaces.
‫And a negative result comes back, but also the data is reflected.
‫And the value is still in the early.
‫So view the page source again.
‫And this is my input and it is reflected to the page.
‫So like I did in the previous lesson, paste the HTML, H1 tag.
‫OK, it works.
‫And paste the NBA link.
‫OK, so something went wrong here as view this horse.
‫Link is here.
‫OK, I think I found it, did you?
‫So the single quote caused the problem with Jason.
‫So if I add back slashes before the quotes, it will work.
‫So this problem is solved now before we go any further, I do want to show you the code.
‫So open terminal and just have a look with me.
‫Now, here, if the level is low, the title parameter is used as is.
‫It was not low, it is checked with a function.
‫Then the output is generated.
‫And scroll down.
‫So now here is a script.
‫And the output is added into the script.
‫And then, as you see, if the result is negative, the search term is sent back to the browser.
‫So go back to Firefox's.
‫And we can run HTML tags entered into this field.
‫So let's paste this tiny script.
‫OK, no, it doesn't work.
‫So now to figure out what's happening, let's view the source.
‫Because my input breaks the original script, right?
‫Now, this part is between script tags, so it can't be executed if there's, you know, anything meaningful.
‫And the rest is not between script tags.
‫So the browser uses the remaining part as text, so displays text in the page.
‫So now type ironmen to clear here and do the source.
‫Now we can create our payload, which doesn't break the original script.
‫So I'm going to just write it here.
‫And step by step, I will create the payload.
‫So first, let's close these double quotes around our input.
‫Then using this curly bracket and then this bracket and then the single quote around the Jason data.
‫And a semicolon to and this line.
‫And close the opening script tag.
‫So now we can start our payload.
‫First alert, the cookie is always then add an opening script tag.
‫And that's it, so let's copy this payload.
‫And based in the search box.
‫And yeah, the JavaScript code executes.
‫And that's a view, the source to figure it out better.
‫And this is the first part.
‫So doesn't have any meaning to the page.
‫And then this is our actual payload.
‫And then this part is the remaining code.
‫It also doesn't really have any meaning to the page.
‫OK, so let's go back to the page.
‫Now we can send the session value to our kookie steel wrap.
‫And we have the payload.
‫So I'm going to copy in and out of here instead of the alert code.
‫Then copy this line.
‫Open a web developer tool.
‫Base the code into the search box and go.
‫The requests sent from this page are below.
‫And base64 cogie value is sent to our stihler application.
‫So if you the source.
‫So our good payload is lying in the source.
‫So open this dealer at.
‫Refresh the page.
‫And the cookie values come up.
‫So now let's go to our session.
‫This is our user.
‫And we are able to send the user session.
‫OK, so go back to Kalli.
‫Now we can use this URL to get any user session.
‫So we get to see the user to click on a link comprised of this URL.
‫Then get the session.
‫And we've already done that in a previous lesson.
‫So I'm going to leave that for you to do.
‫All right.