All right, welcome back, everyone.
This session is about Store Texas, a second store exercise attack, and this is going to be pretty
quick.
I just want you to see how this works in the real life.
So mostly mostly works on the forum or on the blog site where you have comment options.
So you might have seen that on many blogs where there is a comment option enabled.
Right.
So that's where if somebody if if the site allows anybody to submit comments along with the script as
well, and if the if the sanitisation is not happening on the outbound direction, on the outbound direction,
then every new users, every every users after that will be getting the script back to them.
All right.
So let me show you with be Abdool itself will be going to our machine for this.
All right.
So this is where it is.
We'll be logging in to the OAS, BWV and belonging to the evap.
That's going to be back when the field and the test that's get the Crossette scripting stored block.
OK, let's start over hanging.
You see, there's some something has been posted.
Let's say I post something, maybe script along with it, along with your blog comment or anything I
can mention.
There's a lot.
Hello.
So let's say I tested some of those amateurs, I've been hacked and let's say it's a new user, I probably
will refresh the page.
You know, it'll still be there.
That's why it is persistent.
Let me let me refresh the beach.
You see this?
You have been hacked and have a message.
So all the doors will be loaded.
There were two already present JavaScript, which was you have been hacked.
I just added hello.
And if you keep adding more and more JavaScript, it will keep giving you back as well.
So the conditioner's for this kind of attack to work as the site has to be compromised.
Site has to be infected with the stored exercice.
That means if somebody's any any hacker, if it is allowed or anybody is allowed to post a JavaScript.
So in that case, the website is loving.
This Web site is accepting this script.
That's the first problem and giving back to all the users that the second problem.
OK, so if that's the website we see, that means all the following user who is coming after the compromise
mission will getting compromised.
But this attack and that's why it is so severe.
All right.
I hope you got the idea with this.
Will get you and will get you in the next mission.
Thank you.