‫So here's yet another lesson on known vulnerabilities, it's almost inexhaustible, really.
‫So in this lesson, we're going to exploit and other rescue like manage your vulnerability, but this
‫time you're going to memorize your access knowledge and I'm going to skip the detection of rescue.
‫Right.
‫Manager and version.
‫So right now, go to exploit database.
‫And we have already listed the vulnerabilities.
‫And we've even exploited two of them.
‫And there are a bunch of others that match our askew white manager version B box, so there are several
‫excess has vulnerabilities.
‫Yes.
‫So I'm going to open all of them.
‫And I think this one doesn't actually work with our version on our system, so I'm just going to eliminate
‫it.
‫And the second one.
‫All right, so this version matches.
‫Now it looks like there is an excel in the DB SPL parameter in the you are Al.
‫And the other one.
‫But this one is only for Internet Explorer, so I'm going to skip this one.
‫OK, so I'm going to look for this, your URL.
‫So go to the manager interface, enable Foxe proxy.
‫Now click the database.
‫And go to berp.
‫So the request will look like that.
‫So send it to the repeater and then forward.
‫Forward again.
‫Another DCL parameter is in the euro, send this to the repeater as well, and then forward.
‫Another request with DCL.
‫And send that to the repeater and forward.
‫And then go ahead and forward the rest.
‫OK.
‫So the page loads now up in the repeater.
‫So this is the first request we sent and I'm going to paste the payload here, then send.
‫And the response turns back, so type here, alert.
‫And we have the payload here.
‫And they can cause excess has vulnerabilities, but the last double quotes after the payload can prevent
‫execution.
‫So open the second request.
‫And paste the payload here as well.
‫Then send.
‫There's no alert code in response, so this means that the payload does not work here, so we'll go
‫to the third request.
‫This payload here is well and send it.
‫OK, so now we can see the color code here.
‫And also, the exploit code shows this you, Earl, so let's try it.
‫Delete this part of the URL.
‫And right, the payload.
‫And sure enough, the JavaScript code executes.
‫But to exploit a user, this page is not very convincing.
‫I don't think.
‫So we are going to need to make a few changes.
‫So let's copy this HTML code and we're going to prepare a payload step by step.
‫So first, let's close this tag.
‫Now, put in the alert code.
‫And then add a script tag to put the rest between script gags.
‫So paste it into the URL and go.
‫This time.
‫The page this way is much better.
‫So will view the source.
‫We can also complete the tag.
‫So use this payload.
‫That works well.
‫View source.
‫OK, this horse is better now.
‫Now we can write more accurate and more powerful JavaScript payloads.
‫Because the first part is complete and there's no error, so then our actual action payload comes.
‫And the last script tag eliminates the remaining HTML code.
‫OK, then open web developer, and now we can cookie the cookie stealer app.
‫So paste this payload and go.
‫But nothing sent to our server.
‫OK, let me just check the payload real quick.
‫OK, let's view the source code.
‫Now it seems right.
‫Ah, so here's our payload.
‫I see what's wrong, so something happens to the plus sign at the back end.
‫So we need to find a solution instead of this plus sign.
‫Yeah, you probably guess what we're going to do, we can solve this problem with a JavaScript function,
‫so I'll just change the plus sign to concat as our function.
‫And paste our new payload into the You are Al.
‫OK, so this time it sends the cookie value.
‫Open up the STELARA application and refresh the page.
‫There's one session.
‫So log in.
‫And here is a new session.
‫So let's check to see if it's alive.
‫And it is live.
‫So go to session.
‫And here is the user be.
‫OK, so in this lesson, we exploited an excess of vulnerability on askew light manager.
‫So we also get the BWB session ID as well.