‫Cross site scripting or access is one of the most common vulnerabilities of Web applications.
‫It's caused by improper input and output validation.
‫So generally, it happens by including malicious client side scripts in Web pages, and when a victim
‫visits the page or exit code injected link, then the malicious script code is executed.
‫And at this point, the victim's browser is no way to determine whether the script is trusted or not,
‫so it'll just execute the script.
‫And by the execution of the script, it can access cookies or other sensitive information retained by
‫the browser.
‫Such a script can even rewrite the entire content of the demo document.
‫Although excess attacks are possible in VB script, ActiveX, Flash and even cIass has the most used
‫language, of course, is JavaScript.
‫So executing untrusted JavaScript code in browsers can have devastating consequences.
‫Anyway, we can divide excess asset attacks into three types reflected, stored and dom based excess.
‫So in the next few lessons we're going to cover excess has flaws in detail.
‫So this type of excess has vulnerabilities occur when the malicious input in an HTTP request is immediately
‫returned to the victim's browser in an HTTP response.
‫So the militias input data is not stored on the backend, so that's why we call it reflected.
‫Well, the attacker enters is reflected to the victim quickly.
‫And it's also known as non persistent or first order or type one excess.
‫Reflected excess vulnerabilities, required a malicious script to be embedded into a new URL.
‫So as a pen tester, we should try to find a way to entice the victim user to click the link containing
‫the malicious script.
‫Now, in order to be successful, the user needs to click on the infected link.
‫But before that, we need to use whatever social engineering technique we need to deliver the infected
‫link to the potential victims.
‫So open carry and longing to be web.
‫Just like we always do.
‫Now, as you can see, there are many examples of excess vulnerabilities in B Web.
‫And I'm going to exploit some of them, not all.
‫So let's first choose the excess reflected get.
‫But it's nothing but this sample page.
‫But what you type in the fields will be reflected to the page.
‫And then the values will transmit over the you are Al.
‫And view the page source.
‫And here are the values I typed, so this is a suspicious form.
‫OK, so now let's have a look at the code.
‫Now, here at the beginning, there is a function named excess, and it calls excess as check three
‫and check for functions according to the security level.
‫So scroll down a little bit.
‫And it grabs values in the form and it uses them in the exercise function.
‫All right, so if the level is low, the values will be printed on the screen directly, if not, access
‫has check three and check for functions will be executed for medium and a high level.
‫And this function is in this file will scroll down.
‫And here are the functions, so check for uses and slashes function to prevent these characters.
‫And check there, he uses HD amoun, special chars function with an encoding show, go back to Firefox's.
‫And I'm going to paste HTML one H1 tag in here.
‫And it's executed.
‫So view the source.
‫And here's a problem, so the input is not sanitized at the back end.
‫And added the source of the page.
‫So.
‫Let's look to see and there's no difference between this tag and any other female tag on the page.
‫Now, encoding or anything else, and this tag is reflected with the page to us again.
‫So now I'm going to paste another female tag.
‫And it's here in this source.
‫OK, so this time I'm going to add this tiny JavaScript code.
‫And it's also executed.
‫So you're the source.
‫And here the script tags that we sent.
‫And now I'm going to change this JavaScript code a little bit.
‫Then fill in the form and go.
‫And in the message box, we see the cookies.
‫And the session ID as well.
‫So.
‫How do we benefit by executing JavaScript in the browser?
‫So JavaScript provides us the power to do many things, browser design.
‫But we do have to use a browser, so in order to hack, we need to execute JavaScript in someone else's
‫browser.
‫So copy that you are out and open another tab and paste it and go.
‫So you can see JavaScript payload in your L is executed as soon as I open the page.
‫Or in our scenario, clicking a link.
‫So we needed to see the user.
‫To click a link, right?
‫But alerting the session ID is not a good way.
‫So you can use this code, it will send base64 encoded users cookie to my application.
‫You can download and post it on your county or your host if you like.
‫It's a simple bootstrap for app.
‫So paste this payload in here.
‫Open the web developer tool, then go.
‫And what do you see the code has sent to the server?
‫And nothing happens at the back end.
‫Then the JavaScript code is reflected to the page.
‫And then this JavaScript code executes.
‫And sends the encoded cookie value to my grab page, so if you source.
‫And our payload is perfectly displayed here.
‫So now go to the cookie stealer app, refresh the page.
‫And we have an incoming session.
‫So quick to log in.
‫Username is a Web site and password is one, two, three, four, five.
‫And the cookie with the session ID is here.
‫Now, from the more button, you can view details about incoming requests.
‫You can check to see if the sessions live or not.
‫Return to sessions.
‫Also, you can view the main page on BWP.
‫And as you can see, here's our current user.
‫OK, then go back to Cali again, and I validated the excess vulnerability, so now copy this, you
‫el.
‫Then logout.
‫Open back up with just as another user, so log in to it as be Web user one.
‫And let's say somehow I I've sent the link to this user and the user clicks on it, so that means I'm
‫just going to paste it here and hit enter.
‫View source.
‫The value in your URL is lying in the source.
‫And go to a cookie, steal the rap, refresh the page, and here is a new users cookie.
‫Now go to session.
‫And it is bwp, yuzu one session.
‫So we stole this idea value of a user and will use it to authenticate ourself.
‫Good, so let's have a look at some other examples.