All right, so welcome back, everyone, to the freshness and the station is about seeing origin policy.
We have learned this.
We have got to know about this in the last session where we have understood about a challenge for JavaScript.
The challenge was with the when we can actually insert JavaScript code into the other domain.
Right.
That was the challenge.
And remember that this is not the usual redirection when when you type on something on the you are on
the Web browser and you get the redirected from example one dot com two example, do dot com than to
zampa three dot com.
You usually have been in case of payment gateways and all those stuff.
This is where this is where the situation when you get the EDP response on your web browser and that
consists of a JavaScript code and that can lead you to redirect to another website.
That's for the challenges in that situation.
Any random website can mislead you to any other website.
Right.
So this mislead of information or mislead or three direction is being ratified by this policy called
Team Origin Policy.
Let's understand a bit more so I but I understand the position was a bit difficult to digest.
So indisposition will try to try to connect all those dots so that our mind would be easily mined,
can easily digest the information again.
Right.
So let's understand first.
Paulus, first thing to understand is with S.O.P is we cannot directly inject this script into any other
domain.
If we if we try to do that, it could be allowed based on three rules, based on three criteria, as
I would say.
First, the protocol should match on both the domains.
Second, the domain should match the domain name.
Right.
The domain name of the website should match third as the port.
The port.
No, maybe the DCP board.
That we are talking about by default.
SDP runs on 80 steeps, works on four for three.
Even both of them has a different protocol and the board number as well.
So we won't understand until we take the real example here.
We take we need to take the example to understand how exactly it would work.
So we'll be taking a different set of you are and will try to understand if that really works, if the
redirection would really work.
So this is our source website.
This is our originating Web site.
OK, this is where you are at this moment.
The example, Decider's Abdali example, dot com Anzar in certain directory and dot e-mail, because
that's where you have some JavaScript go into it.
Right.
So let's understand if the redirection from here to the next would happen or not.
If you are Alastair's in this case, you will see the URL is Abdali example.
Dot com slash does now slash other bodansky if you see the same same right as HDB.
The DP protocol is same domain name is same Abdah example.
Dot com domain names, same borders, same because SCDP both works on it.
I mean it really works on A B and both are.
So it works through that action would happen.
I mean the S.O.P policy is satisfied so it would be successful injection of not really redirection,
it's the injection of JavaScript code would be happening.
Right.
Second, if you see in this case, you have a domain name, same Abdah example, dot com directories,
exactly the same again.
But hey, what you have SCDP is that breaks the rule because the board has been steeps works on forefoot
for four, three.
And again, this is a different scheme altogether and it's not going to work near the in an injection
of the code.
The insertion of the JavaScript code won't really happen.
Won't work.
Next SCDP ab dot example, dot com.
That's code going.
Oh my God.
This works on board.
Eighty one.
Hey I just told you about it.
Works on it but will understand this way.
This is the default Budapest UDP at.
And even work on any random boat, no, except the default one, you can run it on eighty one, eighty,
eighty, eighty one, eighty one.
And in an unknown number, if the boat number changed, then the S.O.P policy changes.
Well, and you cannot insert JavaScript code in that situation.
And finally, example, dot com, it's again the DP, but with the domain name has been changed.
It's a different subdomain altogether.
Subdomain is again a goldmine.
And so because the domain has been changed S.O.P policy, the S.O.P rule breaks and the injection of
JavaScript won't happen.
I hope you got this sense about what exactly all this and this might have given you a sense of sense
of understanding about when the JavaScript code can be inserted and when not.
And by using this technique itself, by making and making this S.O.P itself in your mind, we have to
play across it to perform or hacking.
All right.
I hope you got the idea so far.
This is a solution.
Remember, this S.O.P is a solution to take care of the entire domain JavaScript code, insertion or
injection.
That's why this cannot be performed.
This cannot be converted into the hacking in a way.
So being in Hacker, we have to find some alternate solution to take care of it.
Right.
So let's get started from our growth, said scrutinization from the next lecture.
We'll see you then.