All right, so welcome back, everyone.
The seriousness and the search is again on reflected excuses about why.
Well, because I understand this is not a straightforward topic, to be very honest.
You find a lot of content on the Internet, but you won't be able to correlate it on very first glance.
Right.
So I'll be putting some more strength on some of these, you know, the specific this topic, because
if you understand this, it would be easier for you to understand the story as well.
Right.
So let's get started.
We'll take the same example, but we'll be going a bit deeper into it to understand what exactly behind
the scenes story is.
Same example.
They have a factor.
We have a hacker and the victim as well.
And of course, the hacker has in the in the our example hackers send an email.
The e-mail was having a link.
And that's where the story starts.
I won't want you to visualize what how exactly the e-mail really looks like.
So let's say an example of maybe, you know, maybe e-mail says there's a product and worth of maybe
maybe ten thousand.
And by the way, we have you know, we are giving some freebies and all that stuff by right away.
And this is the line.
Click here all for ending in the next 30 minutes.
You just you would just be mom, you you know, if the user get if you use it, really get compromised
by looking at the e-mail, he would probably click on the e-mail.
Right.
And that's e-mail when you hold the your e-mail cursor, I mean, your Moscoso there, you will probably
get to see that link on the dot on the extreme bottom of your browser.
Or probably you can copy the link as well by right.
Click on it.
This is how it really looks like.
You get the browser and you get the website address and there is a question mark and that's basically
the search query.
Now, this is the Dallas script called JavaScript Code.
It can be mean as the malicious code as well.
Maybe by redirecting or have many, many purpose in the same script code, we can have any other activity
or many other malicious activity could be done as well.
And it could be pretty longer, too.
So let's imagine it's a really malicious code and what's going to happen next as it is belonging to
the CTP website.
And there's a code as well.
But first task is to root for if the user click on it, it should be user should get redirected to a
website.
Right user just click on it.
It should get redirected to a Web site.
And of course, this site as an example, dot com and which is already vulnerable.
What I mean to say when I say vulnerable is because if you remember, if you're following me correctly,
the output sanitisation is not really happening with this website.
That means the website is not really looking at what really going outside of my of my arm, you know,
outside of my interface, just maybe.
So in that case, whatever the script, scapegoat the user, just click on it.
The request as a part of the world goes to the website and there's a JavaScript code as well.
If it is not really looking at the response side, what is really going out?
The response will be the JavaScript code as it is.
And this is what I'm really talking about.
The as a part of the request, this goes to the vulnerable site example dot com that includes the JavaScript
and website sends Dedalus script code as it is to the user vector machine.
You can see it to see him go over there.
And when this is being used by the Web browser, the client machine, web browser, maybe Chrome or
any kind of Web browser on the machine and runs on it.
And if it is malicious code in our case, yes, it is.
And in that case it will send the request to the hacker machine and then a hacker can completely control
the computer, the machine.
And now you can see it is completely being compromised.
Right.
This is what I wanted to add.
And the part of Reflected Xerces, I hope you like the session will catch you in the next one.
Thank you.