‫Stored as also known as persistent excess, is the most dangerous type of excess, stored excess generally
‫occurs when user input is stored on the target server, such as in a database in a message form.
‫Visitor log comment field, etc. and then a victim is able to retrieve the stored data from the web
‫application.
‫Without that data being made safe to render in the browser, the attacker prepares the email request
‫and sends it to the server.
‫The servers stores the input sent in the request.
‫Any time a visitor visits the page, which contains the output produced using the malicious request,
‫the tampered page is returned to the visitor.
‫Since the malicious code is stored in the server, the attacker does not have to convince anyone.
‫Every visitor is a victim now, so let's see the stored excess in an example, we use -- vulnerable
‫web applications for this example.
‫Go to the OWASP Broken Web Applications Home page.
‫And click Dam Vulnerable Web application like.
‫Log into the application using user slash user credential.
‫Go to store access page.
‫Now this is a guest book which stores visitors messages.
‫When we submit our message, it's stored and displayed to the visitors in each visit, as you see the
‫application produced an output using the user input to examine if the application validates the input.
‫We submit some script code with a script tag.
‫And done.
‫The output contains the script, and the script is interpreted by the browser since a script is stored
‫on the server.
‫It will be sent whenever the page is visited or to whomever visits the page.
‫Of course, the attacker is able to do way more than just giving alert messages.
‫Let's prepare a message to collect the victim's cookies.
‫So for this time, we create a new image in the script.
‫We reached the max length of the edit box, but we already know how we can keep going, so let's change
‫the max length of the box.
‫Said the image source.
‫As a Takaka.
‫So the victim sends a request to attacker ICOM to get the image.
‫We give Document Cookie as a parameter of the request, which sends the victim's cookie to attack Dot.
‫Now this point, let's watch the traffic between the browser and the server using Burp Suite.
‫As you see, the victim's browser has sent a request to attack rcom and sent the cookie of the victim
‫as the parameter.
‫Now the attacker has a list of cookies, which contains the cookies of all visitors.
‫If you have this session idea of a user, you can act as that user in the application.
‫So here's a nifty example from the real world.
‫Remember when MySpace was big?
‫MySpace is a site for keeping up with friends, meeting new people.
‫It allows you to set up a profile and web page with a limited ability to make it look and feel how you
‫want it.
‫In 2005, Sami Comcar has decided to make his MySpace profile cool after a little bit of messing around.
‫He found that he could put in a longer headline than what they allowed and of course, he put cool effects
‫onto his page.
‫Then he put a code to his profile, which does two major things.
‫First, anyone who viewed his profile who wasn't already on his friends list would inadvertently add
‫him as a friend.
‫Second, the code added itself to the visitor's profile.
‫Now, that means anyone who views their profile also adds, Sami is a friend and then anyone who hits
‫those people's profiles, adds Sami as a friend and so on and so on.
‫So if five people viewed his profile that five new friends, if five people viewed each of their profiles.
‫That's 25 more new friends MySpace, Wurman, Sami, Comcar hiker Jesse Collins https colon slash slash
‫Sami Dot pls slash popular slash.
‫OK, so let's have a look here before the code is added.
‫Sami has 73 friends.
‫One hour later, Sami has 73 friends and one friend request.
‫Seven hours later, he has 74 friends and 221 friend requests one hour later.
‫He has 74 friends and 480 friend requests.
‫An hour after that, he has more than 500 friends and more than 500 friend requests.
‫Three hours after that, he has 2500 friends and more than 6000 friend requests.
‫Five hours later, he has 2500 friends and more than 900 17000 friend requests.
‫Three seconds later, more than 900 18000.
‫Another three seconds later, more than 900 19000.
‫And a few minutes later, he has more than one million friend requests.
‫And after a while, Sammy's profile is down for maintenance.
‫Before talking about the dam based exercise, I should tell you a little something about the document
‫object model.
‫So dumb document object model abbreviated as dam, is a cross platform and language independent convention
‫for representing and interacting with objects in HTML.
‫The nodes of every document are organized in a tree structure called the Dom tree dom based excess,
‫as can be thought of as a subclass of reflected excess.
‫The malicious data does not touch the web server.
‫Rather, it is being reflected by the JavaScript code fully on the client side.
‫Now, in reality, these three access types overlap.
‫You can have both stored and reflected DOM based access.
‫You can also have stored and reflected non-dom based access to the since.
‫That's confusing.
‫So to help clarify things.
‫The researchers proposed using two new term to help organize the types of access that can occur.
‫Server access client access.
‫Pretty simple, huh?