All right, so welcome back, everyone.
This is speech, and this is another very fresh section.
This is about cross site scripting.
Trust me, this is one of the most popular topic among the website application, security, vulnerability
assessment or whatever you say, you know, ethical hacking for Web application as well.
So Web site scripting has been there for as being there for a while.
I mean, for many years, in fact.
And it is very important to understand this.
And but in order to understand the scripting, there are many documents.
There are many articles for us.
But we really if you really want to understand how this really works and what exactly this attack is
all about, scripting is an attack.
Remember this and this attack is only possible because of some vulnerability.
OK.
And we'll be working to understand what this vulnerability is all about.
OK, and let's start from the beginning.
Let's start from the fundamentals.
Let's start from the web.
Let's start from the JavaScript.
That makes it possible.
All right.
So the that's why we have sort of a JavaScript, and it is very, very important to understand JavaScript
because the now whatever you see on the Internet is all because of e-mail and JavaScript.
OK, and for your information, Java and JavaScript is nowhere that although both our programming language,
but they are both foir very much different.
OK, I understand this what the purpose of JavaScript is to make the user experience more engaging,
more useful.
What happened, you know, you that even makes the job of developer pretty easier.
Right.
There are many forms that you fill up and you immediately get a problem saying, hey, you enter a wrong
password.
Hey, prior to entering the new password, it would have been seen.
But this makes the when you make use of JavaScript as a coding language, it makes a very triggered
or very spontaneous or very active response to the user saying, OK, I need to change it without in
a very real time, without even filling up the entire form.
You immediately get the response saying, OK, there's something wrong because you get a pop up on your
windows saying, OK, change this, change that and understand.
So that's all possible because of JavaScript, all lovely looking website or wonderful user interface
on the you know, on their Web application.
It's all possible because of JavaScript, whatever the file you see with its own JavaScript.
Now, JavaScript has been available from the beginning, not from the user side, from the user side
programming.
When it's a user site, it's all all about Web browser.
Right.
So from the Web browser side of browser site programming, it has moved to the server side as well.
And now because of no juice and bluejays express, is it made the job even more, you know, made the
programming even more fantastic and makes the platform even more realistic and realtime.
So that's why you see some heavy platform, you know, Web application.
It's all possible because of JavaScript.
Right.
So it's a scrappy language will understand piece by piece.
And when I say scripting language specifically, it's a it has a lot of dynamic content, a big multimedia
and animated images.
So it's all possible because of JavaScript.
Then, as I told you, it's a client side language and it features there are many features of it storing
the useful information like user credentials, not really credentials, but user related informations,
you know, are forms, first name, last name, location, all the stuff there's JavaScript based form
makes the job very easy.
Pop up windows and all those type APIs.
Of course, all the apps that you see, it's all based on API, I mean, Albie's and JavaScript and
points.
So that's where you get get and post APIs where you can share the information and you can fish the information
with the EPA.
Don't you see many of the travel website or maybe you log in to prove that?
I'm sure there are many, many, you know, aggregator traveling website.
You go there.
But they don't really sell those stuff, right?
They don't really.
If you go to any hotel, dotcom or any any of those websites, they don't really sell those products
by themselves rather than redirect you to somewhere else, but just give you the best product listed.
That's all possible because of the EPA.
So this all Web site, who could be aggregator, they fetches the information from thousands of website
and make it available for you.
And you look at Yahoo!
Dot com.
Right.
So and Yahoo!
You get the feed coming on the main page.
You get the feed coming in from four news for, you know, for information related to weather forecast,
for crooked news for any of the sports news, football matches, update and many others.
So it's all possible because for every other feeds, website depends on the other dedicated website
like Weather Channel.
Right.
So from there, get the feeds.
That's all possible because of the API that the application programming interface and with data communicate
to the other platform, other domains as Summerside use cases.
Of course, I told you that make use of energy is expressed in single digits and many more.
Right.
So that's what makes the JavaScript so useful.
Let's see how it does.
It looks like when you you know, when you understand how how JavaScript makes the job pretty much interesting.
So here is our system.
Here is our time machine running, let's say a browser, maybe Chrome at this moment.
So when I say about Web application, remember that the client is always Web browser.
OK, it's not the end host.
When I say the client side it.
So the browser side.
So all the intelligence of the Web browser sites on the browser itself.
In fact, there's a JavaScript engine for every browser.
So every browser have to have their JavaScript engine, which fetches the information from the server
side and runs on the browser and give you the response rate.
And on the Web server side, you have a website called Example Dot com.
Right.
The request goes to the server, the client in the request, because we SCDP get requests for maybe
get requests could be on the you are right.
For example, dot com.
Maybe he just wanted to get the homepage.
We want to reach out to example, dot com and want to browse it so it would be SCDP get request.
Now what would be the response.
The response could be two hundred.
Okay.
Right.
That's a response quote if the site is available.
Right.
So the response would come back usually what is really the script is all about, because if you see
JavaScript it is all embedded, it's all inserted into the e-mail code.
What I mean to say is if your homepage has a JavaScript defined somewhere, it will simply be inserted
into the e-mail code.
And if you know the e-mail code, it has got two parts at the head and the body.
So in the when the job you talk about JavaScript, you can have JavaScript defined anywhere.
So if you let's say you inserted into the body, you just have to make sure you use the right syntax
script starting with the and script and then just slash including actor.
This is how the website really looks like.
So maybe the website has nothing but just the website as a title.
So it has to part it is it has got its esteemable header and the body is well and I'm talking about
the body part in body.
We have inserted this script and the script says, Alert, welcome, welcome.
What, what's your name?
And that's where the script get completed.
Whatever you insert here, that becomes the program, that becomes the execution.
So what are we trying to do is we are saying to this program, this code basically this is basically
hosted on example dot com server.
And this has this has got an e-mail page which says Pop alert is all about prompt or console or giving
the prompt response output as on the browser.
So whenever somebody open up the browser or reach out to the website, they get the prompt open on their
browser, open on the browser, and it must say, welcome what to me for that the alert is the function
which is being used in the back.
And you see the same name.
Right.
And of course you need the code as well, which is.
Missing here.
So that's what you see if you zoom in, you get the idea on the browser, you see I have made it personally
so you could see it says welcome what to name because we tried we made use of the script.
OK, so that's how you get to see a prompt opening on your Chrome browser.
And that is an embedded page.
And this website says, welcome, what's your name?
All right.
So that's what the job of Java script.
And that's what makes the Internet so scalable so faster as well, because that makes the the the response
to the user pretty quick, very dynamic and pretty much on realtime.
All right.
So this is about the Java script and the next session will understand some of the security challenges
with that and what that does to the next level of solving it.
All right.
So we'll see you then.