‫Now, this type of access, as is kind of rare and hard to find.
‫But it may have the consequences similar to the reflected excess, so basically in this vulnerability,
‫everything happens in Dum.
‫These attacks occur when the Web application uses data in the dorm with JavaScript in an unsafe way.
‫OK, go to Kelly and log in to be Web.
‫Now, there are different types of excess that are present in this area, but Dom, excess as does not
‫appear here, so I don't know why.
‫However, it's not a really big deal because we can always import our own dumb excess as example.
‫So go ahead and download this sample page.
‫I've coated it and integrated it to work with a BWB security model, so you can just go ahead and import
‫the page into the BW folder and then use it from there.
‫Okay, so now I'll assume that you've already done this, so open the page to, um, excess dot HP.
‫And the default level is low, as always, but before going any further, let me explain a couple of
‫things.
‫So previously we talked a little bit about Dom, right?
‫You know, it's like a I don't know, it's like the back stage.
‫So you see the stage in the show happens out there, but everything is set and controlled from backstage.
‫Yeah.
‫So Dom is really the backstage of browser's.
‫All right, so now what if you're able to find sync and change some of the sources it backstage, what
‫happens?
‫Well, naturally, the show would be affected by this change and Dumex SS works a lot like that.
‫So in this context, a source is JavaScript property that contains data that the attacker could potentially
‫control.
‫So an example of a source is location dot search, which reads input from the query string.
‫And a sink is a function or dumb object that allows JavaScript code execution or the rendering of HTML.
‫Now, an example of code execution's sync is eval.
‫And an example of an HD Mensink is document body dot, inner HTML.
‫OK, so on this page, there are several sources to play with.
‫I'm going to continue with the first one.
‫It provides a language selection function.
‫So choose a language and select the URL will change to this.
‫Type parameter specifies this source type and a langue parameter defines the chosen language.
‫So if you this horse like we always do.
‫And as you can see, here is JavaScript code.
‫And it uses the data in the document that you are source.
‫So it looks for the lagging parameter in the early.
‫Then uses the decoded value of this parameter in the HTML option tag.
‫So then this Java code is what you're going to see when you view the source.
‫Now, there's no way to understand for me from the source because I chose Spanish, but if you do,
‫you dumb, it differs.
‫So open the developer tool, then pick dropdown element and look at the code in the inspector tab.
‫It shows the latest source for the browser to display the chosen language.
‫So we can determine the chosen language here.
‫Now, enable Foxe proxy and choose English, then submit.
‫Berp gets the request very straight and forward.
‫And the response comes up, so let's look here, there's really no way to understand the German language
‫directly, right.
‫But the JavaScript code uses that you are elsewheres and detects the language.
‫So now let's turn this into a mechanism that will execute scripts for us.
‫Just add an alert code to the end of the URL.
‫And yes, it works.
‫So open web developer and pick the element.
‫And you see here, this is our payload.
‫OK, so now we can use our famous payload to send this session and.
‫And I'm not going to close the developer to I'll need to open it again.
‫And go to the network tab, then paste the payload and hit enter.
‫And we can observe the cookie value sent.
‫So go to the inspector tab.
‫Pick the drop down menu.
‫Open these collapsed parts.
‫And here is the payload that we've entered.
‫So now open the Stelara.
‫Refresh the page.
‫And the first one is the session, and it's coming up.
‫So go back to Kelly.
‫OK, so now let's look at different levels.
‫So change it to medium first, choose the source again.
‫Selective language to see parameters, and I'm going to paste this simple JavaScript code and go.
‫OK, so it doesn't work, but remember, in this level, the script tags are not allowed.
‫And actually, this phrase is not allowed.
‫So we need to create another payload.
‫Open developer, tool pick, yeah, pick the element.
‫Now, here is the option tag.
‫OK, so now we need to find a way to inject the JavaScript code here to execute.
‫So we're going to create the payload step by step.
‫First, complete the opening option tag, then close the option tag.
‫And then close this electic.
‫So now we can write our payload without a script tag.
‫So now I'm going to write this.
‫And I'll use JavaScript in an event method.
‫It's not copy it now.
‫Yeah, I forgot to write something for the rest.
‫I think you can handle that.
‫Yeah, OK, so I'm going to paste.
‫But I'll close the tool and paste and then go.
‫And perfect, the page executes our payload.
‫Now, exploitation will be up to you.
‫OK, so now enable Foxe proxy.
‫And refresh the page.
‫So this is what it looks like in burb.
‫And here's our payload sent to the server as well.
‫So if there is no check at the back end, Dume excess will arise.
‫So forward all.
‫And the alert appears.
‫All right, so the last level, so first choose the source.
‫So like the language, you see the language parameter.
‫And now we can add here our sample JavaScript payload.
‫Yes, alerting code.
‫Oh, nothing happens, so remember the code check to see if the language parameter has one of the languages
‫in the box.
‫So we may have a problem.
‫But have no fear and no worries at all because.
‫You have also seen the solution, do you remember?
‫I'll take you through it.
‫OK, so enable berp.
‫Base the payload and go.
‫We get the request in berp.
‫And see, the payload is sent to the server and this causes the air and then for the rest.
‫OK, so let me go back to clear you are Al.
‫And now I can paste the same payload here.
‫And the way to send this payload to the server may not be obvious, but there is a way.
‫So just put a pound symbol here.
‫And the rest after this symbol won't be sent to the server.
‫So let's hit enter to see look at berp.
‫And the payload is not in the request forward and let it all go.
‫And the alert message appears.
‫And once again, I will leave the exploitation up to you.