Welcome back, I want to quickly talk about another vulnerability or a bug, which is called HTML injection,
and it is quite similar to the cross site scripting attack, just as its name says in this type of the
attack, we're not injecting JavaScript code, but instead we're injecting HTML code.
And you might say that that is not really dangerous, however, even though that is correct, if the
injection is still a book that you should be searching for, why?
Well, if there is an e-mail injection in some big company, what an attacker could do is they could
change the entire page.
Look, they could add whatever they want to that page.
They could post different pictures.
They could completely change that Web page to their own liking just by injecting HTML code.
And that would be pretty bad for that company because someone else would have a complete control of
how that page would look like.
So how can we test for that, how can we find him an injection?
Well, you can just go and navigate to the excess reflected and exercice stores that we covered in previous
videos.
And we can test for Tmall injections here.
So usually what you want to test is different HTML tags such as H1, H2 or different header tax just
to see whether your input will be interpreted as HTML code.
So let's give it a try.
Everything is on low and if I go right here and just type it one, which is an HTML tag for header size
one and they type test, close the tag.
By typing these arrows and then closed each one, I click on Submit and we can see it does indeed interpret
our input as an HTML code.
If we were to type, for example, H two or three and then test once again.
This would be smaller size, which is a good enough indication that there is an optimal injection on
this page.
Now, there is no point of us changing this to medium or high because this specific input is used for
JavaScript attacks.
So only JavaScript syntax will be filtered.
Therefore, HTML injection will be the same on medium level security as well.
As I mentioned, this also back and it should be reported because for now we only typed in a small HTML
code which changes our input to size one header and size three header.
But what we could also do, for example, on a stalled page.
And let me just reset the database real quick from the previous video where we covered the existant.
And if you were to type an HTML injection right here, let's say the name will be test and here we type
this code.
Let me first write it inside of a terminal and then we are going to copy it to this page just so you
can see everything better.
So open brackets and then meta http equiv equals open double quotes, refresh close double quotes,
content equals zero dot and comma and then space.
Your URL equals http google dot com and then close double quotes and close the tag by typing slash and
close right error.
If we were to inject this code, well let's just see what would happen.
Let's copy this code right here.
Go to our page and type it here.
I click on Sign Guestbook.
Do you see what is happening?
It is constantly trying to go to different pitch and it is constantly refreshing that pitch, it pretty
much made the pitch completely unusable because we cannot even go up here and type something in to.
What we must do is we must change to a different directorate such as Phyll Inclusion and go and clear
our database or reset the database because we will not be able to visit the Stort since it will automatically
start refreshing the page and trying to visit Google dot com.
However, if we were to type same right here in the reflected and we want to change, for example,
from Google dot com to Facebook dot com and click on submit.
Well, pretty much the same thing would happen, but for some reason, it doesn't want to visit Facebook
dot com and we going to take a look at why that is that to see whether we specified something incorrectly.
So you are L equals HTP.
OK, so I've tested it out, and for some reason, it doesn't seem to work on Callinan's browser, but
if I go to my Windows 10 machine and I visit the metastable page and right here I copy the same code
that we just sent in our clinics, just we copied and tried from our Windows 10 machine.
I just changed the URL to be Bing dot com is to try it here and click on Submit.
Well, now it fully redirects our access, reflected input and the entire page to this pink dot com
website.
Let's give it a try.
What happens if we do that on the street so I type test as name and I type this comment right here as
a message, and it appears that there is a limitation of characters right here.
So what we can do is we can inspect the element, navigate to the body, then let's go and find the
message input.
So under the form we go table body and message input.
We checked right here, it says that the max length is 50, so what I can do is I can type five hundred
and now if I go and try to copy this, so I'll just delete all of this, page the code and click sign
guestbook.
Well, now it actually redirects.
So you will see that even when I try to go back and I go, for example, to brute force and again on
thought it will just load dot com.
So with the help of code injection, we can even redirect pages to different websites.
And this is usually what attackers do.
So if they find us toward code injection vulnerability, what they will do is they will just inject
a redirection link to a different website, possibly a malicious website or a website where they advertise
something or something similar.
And every time someone visits a page, for example, they want to go and stored on our Metters political
page, well, they just load Bing dot com and that is the power of HTML injection vulnerability.
So now that we covered this in the next video, we're going to go on to another big vulnerability,
which is called Ezekial Injection.
So they're.