All right, welcome back, everyone.
This is resonation, this session is about reflected excessed says that's crosseyed scripting.
Let's get started.
So reflected exosomes reflected X.
S.
S is an attack where basically what happened is it makes use makes use of of of a vulnerability, basically,
wherein the website is not performing any kind of output.
Sanitisation.
Right.
And in this situation, whatever the script given to the website from the user, come back, come back
to the user itself without performing any sanitisation or without looking at what exactly is going out.
Right.
So let's go back a bit in the earlier session where we have discourse about our script and we discuss
about what are the loopholes and the points where the problem may arise when it comes to the Web application.
There is only two points in let's say let's say if it is this is the website.
Right?
There's two points.
One is the inbound and another one's in the out form.
If we don't have the input, essentially, if we don't have the input sanitisation in that situation,
the the the the the attack can send any sort of data.
Right.
And that's where it can perform the Escorial injection attack.
Right.
To the point where we don't perform the input sanitisation.
I mean, in terms of we don't really look at what we are taking inside and giving it to the database.
We can we can be a victim of a sequel injection attack or any sort of injection or death.
But on the other side, if we don't really look at what really going out of the website or web application
that leads to the attacks like this, which is gartside scripting attack.
Right.
And that's what we discuss.
And when we are talking about JavaScript, this is the two points where the application attack could
actually happen when the input sanitisation is not happening and when the output sanitisation is not
happening throughout the script, side scripting will especially be focusing on the output sanitisation,
and that leads to that vulnerability, leads to this crosseyed scripting attack.
I hope you got the sense let's understand especially what exactly that reflected is also reflected is
the point.
It's a vulnerability that reflects the malicious code back to the victim browser.
So reflective script could be simply a script sent to the web browser and come back to back f whatever
that code as the malicious.
So that goes to the website and come back to the user as it is.
So that becomes the Reflektor crosseyed scripting attack also.
And the situation that that makes.
As I told you earlier, attackers make use of this does make use of a website that does not perform
any processing of data.
So they make use of a website.
When I see that, it means that they make use of a vulnerable site on or probably any site, but they
first try to infect that site and compromised it.
And then they make use of it as attack vector.
Right.
Or they could have their own.
But they tried to make use of a website which is already popular, which is a bit popular, where people
can do some transaction and go back.
Right.
So it is easy to it is it is a good idea for a hacker to hack those website where there are people coming
in and going up.
In spite of that, if they build their own site and start doing something by themselves, it is risky
because they have to solve some things.
They have to deliver some value, which is not right, in fact, to be an unethical hacker.
Right.
So that's what it is basically a hacker compromise or in fact, any normal website.
And then they'll let the user come and then the output sanitisation is not happening that come to the
that comes through the reflected Access's attack.
Right.
So remember, in this situation, the hacker will always be looking for any website, any normal standard
website which might be infected by the reflected exercise exercice one.
All right.
But remember this very important point.
It takes time and energy.
Tell you how and hacker sitting anywhere in the world.
Right.
What exactly he need to do in order to perform this attack.
He first need to send sort of an email.
Right.
And kind of phishing email with smart subject line and good content so that the user should open the
user should all.
In the e-mail box and look at what exactly the human body looks like, it could be very much like,
you know, there's a cell, there's a gift hamper or maybe any sort of stuff over there that prompt
user to click on the e-mail, look at the content, and then get rid of some web.
We'll talk about it.
So it should be an e-mail, having some links, right.
User click on it.
And what happened next?
It should be the moment it click on the link.
It should get redirected to a website which is vulnerable.
I'm not saying this is this will be a hacker's website.
This could be any simple e-commerce site.
But remember, this is an infected website which which doesn't perform any sort of or output sanitisation.
That means if that user goes to the Web site and reaches to the Web site after clicking on the emailing
the JavaScript code, which was there on the email link, and with that it reaches to the website,
it comes back to the user again.
And that's what you see as a code.
It comes back to the user as it is.
And that's why it is reflected to the user as it is, and that's why it is called reflected crosseyed
scripting attack.
Now, what happened?
Because the school has been the code has been written reflecting back to the victim that basically compromises
the user machine.
And that's how the user user, aka hacker hacker completely get the access to the victim machine.
Now, you may ask, why do struggle so much?
Why can't I directly you know, why do I really need a separate website?
And why can't I directly attack the victim without even, you know, letting the user to Google one
little bit site and then coming back?
Because this makes the user to this makes then attack more sophisticated and more, you know, genuine
for the user, in fact, to click on it or otherwise.
Nobody.
If even if the hacker sent any malicious code or something, it would be difficult for a user to download
that code and all those subprime.
But in case if that that that get redirected to some website that doesn't require any kind of a malicious
payload, doesn't require a hacker to look into any sort of any sort of antivirus engine and all those
bypass technique and everything.
But this the user will be redirected to a website.
The the JavaScript code comes back to the user again as well, which was there in the email link as
it is right now.
What really happened?
Remember correctly, remember very, very closely that it is caused by the incoming request not being
sanitized right from the server side.
And also, if this was sent to one user, remember this thing that this has, why I told you that this
is going to take a lot of time, because in this situation, you have to send an email to each and every
individual user.
So let me show you how in this situation, we send any link, we send an email to the one victim and
exactly the same way we have to if we need to compromise like thousands of people, we have to send
an e-mail to thousands of the user to sophisticated e-mails, and they click on the if they click on
the e-mail, then they can get redirected within one little site and then they get the code back to
their system and they then they only get compromised otherwise not.
That's why I told you it takes time and energy as well, because in this situation, there is a need
of making sophisticated e-mails and all this stuff.
So it is it is very difficult in terms of and in terms of returns on investment for hackers.
Right.
And second part is sophisticated phishing.
Gambin is really needed for making this making this campaign to be successful for any hacker.
All right.
So I hope you got the idea about what reflected Exercice is all about catching the next mission where
we cover some very much important point about the same topic.
Thank you.