‫So until now, we've injected JavaScript as QoL and XPath code into legitimate data.
‫Now, it may also be possible to inject different languages.
‫So another popular injection type is peacoat injection.
‫So code can be injected into a program or script from some outside source.
‫So the added code is part of the application itself with the same permissions as the application.
‫Now, imagine the consequences with that.
‫So in BIAP, there's also an example for this attack.
‫So you want to have a look and see how it works, open your browser and log in to be Web.
‫And from the menu above, choose peacoat injection.
‫And just like it says, this is just a test page that reflects your message.
‫So if you click here, it writes the phrase test below.
‫And the data transmits over the URL.
‫So view the page source.
‫And here's a park containing the link.
‫The message parameter in the euro as a default value test.
‫All right, so now I'm going to check here, I'm going to check in or something.
‫And see see how the how the link doesn't change, but the value below is changed to something.
‫OK, so I think that what we have here in the message parameter is reflected back to us.
‫OK, so now I'm going to add here a semicolon and then I'll observe how the application behaves.
‫So doesn't print the semicolon.
‫So let's see, maybe it escaped or it's interpreted in the back and.
‫So you can also add a piece of peacoat after.
‫Echo something.
‫And hit enter.
‫Well, isn't that super it executes?
‫OK, so delete the echo function and write up info.
‫Well, that execute as well.
‫So that's perfect, we can execute zip code now on the back in.
‫So he has several functions to execute operating system command.
‫System command is only one of them.
‫So we discover the OS is a Linux.
‫So print working directory.
‫And it shows boabs directory, so somehow we are able to run command on an operating system, but we
‫don't display the content of the magic file because it's not a real hack.
‫Right.
‫And I mean, that's good, because this is the content of the password file.
‫So now it's a hack.
‫OK, so let's move on with burb and enable Foxe proxy and then refresh the page.
‫Open berp.
‫And I just intercepted it to you, Sir Peter.
‫So send it to the repeater and let it go.
‫And here is a request, so send it.
‫It executes again.
‫So now I'm going to delete from here the file name.
‫And.
‫Let's have a look, see where the net cat binary is, which ency?
‫Now, due to you are Ellen Cotting, I'll use the Eurail encoded values of spaces and quote.
‫So I'll send it.
‫Net cat is here under the bin directory.
‫So now I'm going to use Netcare to open a reverse shell on PAYBOX.
‫I opened the decoder tab.
‫And I'm going to paste the reverse net shell here.
‫Now, this line of commands will help us to communicate over another channel with PAYBOX.
‫And in code, as you are.
‫Copy this long output.
‫And paste it instead of this payload.
‫And then before sending the request over the terminal and make sure that neck cat is listening.
‫And it can't listen without a port, so it's ad four four, four, three.
‫Then go back to repeater and send.
‫So as you can see, there's nothing on the right side.
‫Because of the execution of reverse shell commands, so go to terminal and here's a session.
‫The box connects back to Kelly, and you can type Linux commands now.
‫You name a, it is PAYBOX.
‫So this type of shell is a little bit weird.
‫So now if you write this line of python, you will get a shell like Basche Shell.
‫Yeah, I think it's good, so you can type some in command.
‫Yeah, it is cool.
‫So, OK, overall, that's how we use that BHP code injection.
‫And also create a reverse shell.