So hi, guys, in this lecture, we are going to see what other types of cross site scripting, the
meaning of exercise to execute JavaScript on the victim's browser, but there are different ways to
achieve it.
So depending on the design and purposes of the website, there are three major categories of exercise
which you can see.
If one is persistent, then we are having reflected accesses, then we are having DOM access.
So we're going to go at each and everyone one by one.
OK, so first one is we are having persistent.
So this form of crossette scripting or exercise also known as is stored accessors.
OK, so excesses flow is called as persistent excess as when injected data stored on a web server or
the database on the server side and the application.
So it simply it stops it back to the user without validation.
So an attacker whose aim is to infect every visitor of the website would use the persistent or stored
based accesses which would enable him or her to exploit the website on a larger scale.
So this is about the persistence of a story based exercice then we are having reflected based.
OK, so this is for the reflectiveness.
So reflected based Xerces, also known as the non persistent accesses as the names are distinct, died
in the form of a dog normalises script is a part of the victims request up to the application, which
is reflected back by the application in form of the response.
So this may look difficult to exploit as users won't willingly sustain a malicious script or so, but
there are several ways they use it to launch a deflected accessors attack against its browser.
So this is all about reflected then we are having addendum based.
So now let's talk about this.
So this is the third type, of course, that the scripting is the local and directly affected the victims
browser.
So this attack does not rely on the malicious content being sent to the server in the persistent and
reflected beast.
The script is included in the response where the server, the victim's browser, accept it and assume
it to be a legitimate part of the webpage and execute it as a child.
But in case of Doumbia successes, only to meet to meta script that is provided by the Web server is
executed.
So as increasing number of achievement pages are generated by the downloading of JavaScript on a client
side rather than by the SOA.
So any time an element of the web page is to be changed without repressing the entire page.
So it is done using that JavaScript.
So typical example is a website providing a light update of cricket match.
So which references that score section in regular interval.
So guys, this is all about all three types of exercise that we have from the Nicollet John or they
are going to start with our attacking phase.
So this is all for this Lechuga.