‫Now, this type of exercise is the most dangerous one.
‫It occurs when the malicious input and an HTTP request is stored at the back end for later use.
‫So here, the attacker doesn't need to perform any clever social engineering techniques because the
‫malicious script is stored at the back end and then embedded into the pages that are viewed by other
‫users.
‫So the users trust the application and the attacker script is executed in their browser.
‫It's also known as persistent or second order or type to excess.
‫OK, so open up, Kelly.
‫Longing going to be rap.
‫And open access to our blog.
‫And again, it's a sample page.
‫So it looks just like a comment page and you can add and delete your entries.
‫So let's check in here to show all the entries from the other users as well.
‫And here you can see that comments are listed just like this.
‫So you can view someone else's comments also.
‫Let's view the source page.
‫Doesn't look like there's anything suspicious in the source.
‫And the comments are listed in a table.
‫OK, so now I'm going to do the same thing that we did for reflected excess.
‫I'll first try to add HTML tags, so Paiste each email, each one tag and submit.
‫And it works.
‫And paste an HTML link and then submit.
‫It also works.
‫OK, so view page source.
‫And you see, the female tags I entered are lying in the source.
‫They are not escaped, not sanitized, nothing else.
‫So now open a terminal to see the code.
‫And this is the code file.
‫Now, don't confuse this with school injection functions, the actual excess, as Jack happens below.
‫This just prevents you from reforming escarole injections on the same form.
‫So if the level is low, there's no check and the entry is added to the database.
‫And this part is reviewing the comments.
‫So if show all is checked, it will use this Escorial query.
‫Otherwise, it will use this one.
‫And after querying the database, according to the security level, it will show the data on the page.
‫Now, if the level is high, check three is called for, medium check for is called and for low, there
‫is no check.
‫OK, so the best part of these vulnerable applications is this you can view the code and understand
‫the hacking process better.
‫So follow me, go to Firefox.
‫Now, pace, the popular excess, has payload.
‫And yeah, you guessed it right.
‫Document Doc Cookie.
‫So the script executes and a cookie value is printed.
‫All right, so this means that we can run JavaScript on the page.
‫So the next thing to do is collect the session I.D..
‫And that's why I'm going to pass this payload again.
‫And remember to open the web developer tool and submit it.
‫As you watch the web developer tool, the base 64 cookie value is sent to the cookie stealer at.
‫So open the cookie stealer app, refresh the page.
‫And here's the cookie.
‫OK, so go to the session.
‫This is our user.
‫And we're able to get the session ID.
‫So now go back to Kelly.
‫The same change level to medium.
‫And then just add the same payload again.
‫Open web developer as well and submit.
‫And now we cannot see the request since the session two are still here at.
‫So then just right, click on the page and view source.
‫So now, look, the back are added in before this sign and double quotes.
‫And this prevents the JavaScript payload to execute.
‫So remember, in the code, there is an excess check for function, and that's called for the medium
‫level.
‫And this function calls another be built in function and slashes.
‫So that's why we see these extra slashes here.
‫Now, in order to bypass this security measure.
‫There are a few ways, so I'm going to show you just one now.
‫And I'll serve the actual payload code.
‫On my host is a script file.
‫And it is completely the same as the previous payload, except for this script, Tagg's.
‫All right, so after that, I am just going to call that file from Firefox's.
‫And so I'm going to paste this payload here.
‫The source attribute has no single or double quotes.
‫I'm not going to add them because Dom will normalize this code and add it for me.
‫OK, so open developer tools and submit.
‫And look at that, it is done.
‫First, the page includes the script file for my host.
‫And then the script executes and sends the cookie value to the Steeler app on my host.
‫So go to the steel trap and refresh.
‫And the session value is here.
‫That's right, this is our user.
‫OK, so go back to Kelly.
‫Now, let me summarize what what we did here.
‫We validated that there is a stored excess vulnerability on the target application.
‫And why is it stored because of payloads we provide are stored at the back end in a database.
‫So here's a question how can we exploit such a vulnerability to collect the session ID for users?
‫The answer is we don't need to do anything because we already have.
‫So we injected the excess payload into the page and now it is stored in the database.
‫So very user visits his page, our excess payload will automatically execute within their browser.
‫So I'm going to open Chrome and go to Brett.
‫And I'm going to log in as b web user number to.
‫And I'm going to visit the store, Texas Page.
‫And let me just zoom in here for you, check, show all.
‫And write something here and submit.
‫Now, scroll down to see what you display and here's your comment.
‫Now, have a look, though, some of them are not displayed.
‫So let's view the page source now.
‫And scroll down.
‫All right, so look at here.
‫All JavaScript payloads that we tried are here in the page, so as soon as this user opens a page,
‫these payloads are executed in his browser.
‫Then over this dealer app, refresh the page.
‫And a new session opens, so go to check session and all right, so perfect, we have the user session
‫value.
‫See, so this is really cool, huh?
‫So go back to Firefox's.
‫And I want to show you just a small thing here as well, so set the level to low.
‫And I'm going to paste this payload and submit.
‫Now, look here, this is also a way of exploiting the users.
‫So click this link and it will display multiplatform login screen.
‫So this is just, you know, a matter of social engineering, little psychology, so I use this simple
‫login screen, but you can detect and copy other applications of your customers as well and then serve
‫the HTML interface of these apps to be able to use in social engineering attacks, perhaps against any
‫of those companies employees.