Hi, welcome back to another episode on How to Hack.
So today we'll be looking at cross site scripting.
So it is a way for us to actually inject our own malicious script into the Web browser so that when
a user Servet, we can actually show them exactly what we want the browser to do.
So, of course, before we even go into cross site scripting, we want to think about what is JavaScript
and how do Web developers actually build many of these sites.
So the first thing you can think about is developers actually have to look at HTML, she says, as well
as JavaScript.
That can give the user a great experience when you're surfing into the site.
And of course, in this case, JavaScript is actually used to control a lot of functions in site, the
website.
So when we look over here, we have a standard, very simple way of building a hex HTML document that
can be served through a Web application server.
So Web application server could be like Apache that you have seen a lot from the tutorials.
So the right site we can see over here that we got the HTML opening and we got the body and we got the
one which is standing for header header one and we got a script.
So script is of course JavaScript and will be inserting a lot of this over time.
So here we got the alert function.
So the alert function will do a dialog box pop up.
And a reason why we are using this is because it is a lot more visible to know whether a script has
actually gone in successfully.
So that's one of the way, especially in the beginning stage when you're trying to do all this injection
and to see whether the attacks from all the Eurail is actually subjected to JavaScript injection.
And of course, on the bottom left, how is actually the JavaScript in use across all these different
browsers?
So you got Chrome, you've got Internet Explorer, you have Firefox, Safari and Oprah.
So all of them can run the script.
So if they can run a script in Minnesota, we can inject something into the Web server which allow us
to run our own commands.
So moving forward, if you see over here, we got the screenshot of running a HTML page.
So, again, you could run this on your own Web application server.
So you just go to upload the HTML file to Apache Web server.
And from there on, you'll be able to see all of this running inside your system.
And you can just go into the IP address and we can see whether browsers are loading exactly what we
want them to look.
So, of course, going into crosshatch scripting now.
So it is a Web based attack in which the browser interpretor, which is used to execute malicious code
that does not standardize input.
So if you look back at a previous tutorial, we were talking about SQL injection.
So it is almost similar.
But in this case, the code is targeted for the browser, targeted for the user.
When you click onto it, when you go into the page and of course, the script would actually run onto
the browser and execute a kind of commands that we wanted to run into.
A single injection you saw from the previous tutorial was actually to pull a lot of information coming
from the database, truly Web application server because of, again, unsanitized input there.
Do not check for the kind of code is coming into the system.
So what can cross rescripting do now that we understand about cross scripting, how web application
or web development is being built so we can execute any kind of script that we want to run as the hacker
and we could defeat the we can change the code.
We can redirect users who go into the site, and of course, we can even hijack a user's browser.
So a lot more things that we can do because if you can inject your own script into the system, you
can do literally anything.
So there are tricky types of cross scripting, so the first one is actually what we call Staat.
So Staat, cross site scripting is a very simple way of how we could push the script into the database.
So one is in the database.
What happened is that when the Web browser served the content, you'll be served as a JavaScript.
So once it has served as a JavaScript, the users browse through those scripts and immediately will
be able to get those information back.
The second one is reflected, so, of course, this is the part where we're utilizing the universal
in which we're injecting our script instead of you are sending to the user.
And when a user click onto it a little bit into the browser and then ultimately into our script and
when a script runs immediately will be able to run that script against a client's browser.
And a final one is Dom Bayes, cross site scripting.
So this is the document object model.
So this is a way for us to do a in line execution of script.
So this is very browser specific.
So a lot of the more outdated browsers can be subjected to this type of attack.
So the first scenario is on start crossing scripting, which is the simplest way to look at Croci scripting,
so the first thing you look at is on the left side, you got the hacker sever.
All the hack is computer and it will inject a code, a malicious code into the target server.
And ultimately, when the user go into the server, that will execute a script immediately and you'll
be able to do all sorts of commands Sarla redirection, getting cookies, information, sensitive data
and so on.
So where are the entry points for attack?
So if you look on the left side, we have a vulnerable Web application, somebody has seen a lot come
until today.
So you could actually install this very quickly on your virtual environment.
And from there on, you can actually test and learn about SQL injection, cross site scripting vulnerabilities
and a lot more things.
So, of course, in this case, we are inside a particular page and this page has a tax form.
So of course, in a tax form, we can see that we can Qiantang.
So this is the part where we can do a entry.
So if you think about the size of your surfy, this is like a text box and you can put your comments
and you can put different kind of things.
So on the right side, we are injecting a script, a JavaScript into the system.
So when we're injecting a JavaScript, so here we have the opening of script and we go to closing and
we get an alert and the alerts say you've been hacked.
So what happened is that once you hit Sèvres block entry, whoever looks into the page would actually
load the JavaScript.
So on the left side, you could see the pop up dialog box and we can see that you've been hacked, get
shown up.
And of course, on the right side, if you actually investigate on the source code, you could actually
do a search and you could see script alert.
You've been hacked, which means that the script is running as though it is a script out of the browser.
So this allow you to actually run your own KOLO redirecting the whole page, meaning that if you reach
this page, you could be redirected to your correct site.
So here we got another way of actually attacking based on cross scripting.
So over here we are injecting an iFrame on the left side.
So, again, this is a way for us to Imbert content into the site.
So on the right side, we can see that we get the website, load it into the site.
So over here you can see transferring data from.
So this would actually end this site into the iFrame again, ultimately allowing us to embed information
in any form of content into the table.
So over here we have another example where we're using a script, that document kookie.
So we're trying to pull up to kookie information of the client browser.
So again, this allows us to see information inside the browser.
So this would actually give a pop up.
So in the pop up, we can see the session ID.
So again, we could use that such session ID information and we could copy it to a different browser
and this would give us permission into the site.
So Sonata is a little more complicated, so we have what we call the reflective cross site scripting,
so reflect the cross scripting is in a sense that if you look at a step over here on the top left,
we have the hacker server, a computer.
And what you're first doing is you're going into the target server and you're checking whether the server
is vulnerable to your injection.
So what you do is do attach to your URL to see if that they are able to inject scrip inside of you URL
and then sending that link to the target machine.
So when a target machine clicks onto the link together with the script, inject it into your URL that
would get a malicious script executed.
So over here in this case, you can see on the left side, we have the script alert document kookie
so we could send such an information already are to the target machine.
And when a target machine click onto the link, it would actually run the script.
So in this case, of course, we just running to document Kookie, which will of course show the session
ID.
But of course we can also send that information to a separate server to collect all this session information.
So again, is part of cookies stealing, as we can see.
So over here we got the browser specific attack.
So on the left side, we can actually see the file.
And of course, in the file, we could serve this to any of your favorite Web application server and
we can actually do a questionmark name equal.
So again, that would help us inject the content of the information into the body of the website.
So, of course, at the bottom you can actually see the reinjecting, the script or alert.
And of course, you've seen it many times chool, the different earlier examples.
And of course, we can see the dialog box being pop up saying that this site was hacked.
So, of course, this is highly dependent on the browser because some browser would actually sanitize
those input for you to protect you.
But of course, you're using more outdated browsers, actually subject you to just kind of scribbling,
execute it on your client and.
So, of course, you'd be asking, what about more advanced way, because there could be a Web application
firewall to sanitize those input.
There could be a database firewall to sanitize those input before he gets injected into the database.
So, again, they could have many different kind of firewalls to protect against such payload.
So, of course, there's a huge set of cheat sheets or payloads in which you could see on the right
side.
So we go different ways of injecting the alert to test whether the site is vulnerable to such attacks.
So you can see in BrightSource Image, SureScripts source and we got dive and of course we got questionmark
and so on.
So there's a huge list of potential ways that we could inject a payload into the Web server to test
whether they are vulnerable to such attacks.
So now we're going to a demonstration of the tutorial and here this is the part where we are looking
across all three examples of how cross site scripting works.
So over here on the left side of politics, running in the same time, I have mutal a day running as
well on the IP address of one or two one six eight one eight five.
So once you're in here, you can go on the top 10.
So they have a nice category of the Web application vulnerabilities that you could test on.
And of course, today's coverage is on Croci scripting.
So of course, in future tutorial, we'll try to go to as many of them as possible so that you can learn
all about cybersecurity.
So I go on across my scripting, we can actually look at the number of opportunities that we can test
on.
So, of course, we got the reflected.
We got it persistent.
So we're going to click onto add to your block.
So once you click onto add to your block, this is the part where we can actually enter any form of
content.
So I'll say I for example, I enter Hollo.
Today is a great day and I hit enter on debt, so that would save a block entry.
And at the bottom we can see that we got the entry.
Hello.
Today's a great day.
So what we can do now is we can manipulate the data.
So here for example, we can enter script and we can enter alert and we can enter you been hack and
we can actually close it and we can close the script as well.
So once you hit this, whoever goes into the Web page and once they're in the Web page, the will to
JavaScript.
And of course, this dialog box will pop up.
But of course, in some malicious cases, it could be a redirection of page, it could be a stealing
of document cookies.
So it could be many of these potential examples.
So you click on Save Block entry and immediately we can see the pop up coming up.
And it says that you've been hack.
So, of course, in our case, this we can actually go on to login and we can try to log in as a separate
user.
So in this case, I log in as a separate user and I go in to the cross site scripting and I go to Persistent
and I click on View Someone's Block.
So of course, over here we can have a lot of different information.
So I can click on show all and I could click view blog entries and immediately I get the JavaScript
being executed because this is part of the entry of the user by Anonymous.
So if I actually click a right click and I click a view page source and of course I can look for a script
and of course we can look for the alert and we can look at you, Binayak.
And of course, you're immediately and if you're familiar with HTML access, we can see that this is
a table format and in a table format we have an alert of JavaScript.
So here is a script alert you hacked.
So immediately from here we can actually see the information coming out and we are able to see that
you've been hacked.
So again, we are running on this JavaScript.
So now we go back into Ops, top 10, cross scripting, persistent add to your block.
So we click on that.
And again, we can actually look at how we could inject content into the table.
So, of course, if you scroll down, you can see that there are no block entries.
And what we can do is we can actually enter exactly what you saw from the lecture earlier.
We can look at iFrame.
So iFrame again is not a way for us to potentially inject some scrip into the system.
So in this case, we could source and we can enter HTTP, followed by the website that you want to actually
put into the system.
So of course in this case we got iFrame source and we got loyal Yangyang Dotcom and we can of course
close the iFrame as well.
So here again we are following instructions directly from the lecture so we can close the iFrame and
we can enter a safe entry.
So once you hit enter and out we can see the loading on the left site.
And of course as you scroll down we can see the website being loaded into the block entry.
So once again demonstrating how we could inject some of this information into the site.
So over here, we actually have the ability also to inject scrip.
So of course, here we have another example of how we could do a DNS look up on.
So, again, we could also inject Screwtape once again.
So in this case, we can enter, for example, the document kookie.
We can click on Lookup DNS.
So, of course, this would immediately show us the session ID, the user name, as well as the UID.
So of course what we can do is can we can we direct all this data to a different site, to different
server, and immediately we'll be able to get those session information.
So over here we actually got Devoir, which is a vulnerable Web application.
So in this case, we can also injected directly from the user l.
So in this case, when you see over here is you can enter what's your name so I can enter Etman, for
example, and I click submit and he says, Hello, Etman.
So what you notice is on a u r l the l actually specify information over here and it says to name equal
at mean.
Followed by Hack's, so what we can do is we can follow the information that we got earlier from the
lecture slight, and what we can do is we can enter the script directly into the Yucel.
So in this case, I can enter the script again.
We can check whether this particular Eurail is going to be vulnerable to different kind of JavaScript
and that we can inject all this information where we're sending to.
You are alluding to the user.
So in this case, I'm entering alert and I can interact.
And of course, we can close to your limit and hit enter on that and immediately we get a dialogue pop
up.
So the reason we are doing this is because the user is legitimate and because it's a legitimate URL.
The user has a higher chance of clicking to it.
And when you click onto it, it would execute all this Java code.
So on the left side of a Windows 10 computer running and of course, in this case we got a DOM html.
So remember earlier from the lecture slide, we actually have to code here, which is a HTML file that
you could surf into any of your Web application service.
So over here, of course, you can take a screenshot so that you could actually quickly copy the code
invited into your computer or if you want to host it on your application server.
So please go ahead, do that right now.
So once you have it, you can close it and you can just double click on it and it will open on any of
your favorite browser.
And of course, all you got to do at the back is enter questionmark, followed by name equal our ally.
So again, we can specify and change any of those information.
So you see specifically how this actually changed the content inside the browser.
So, of course, ultimately what we can do is we can inject the script into the system.
So over here we can enter script and we have the alert on hack, followed by the closing of the script.
So when you hit enter on that, that would immediately do a dialog box pop up.
So ultimately giving us access into the sensitive content inside the browser.
So once again, I hope you have learned something valuable in today's tutorial as well as lecture.
So of course, if you have any questions, feel free to put a comment below and I'll try my best to
answer any of your questions.
And we'll like sharing.
Subscribe to the channel so that you can be kept abreast of the latest cyber security.
Tiriel.
Thank you so much once again for watching.