Now, this type of exercise is the most dangerous one.
It occurs when the malicious input and an HTTP request is stored at the back end for later use.
So here, the attacker doesn't need to perform any clever social engineering techniques because the
malicious script is stored at the back end and then embedded into the pages that are viewed by other
users.
So the users trust the application and the attacker script is executed in their browser.
It's also known as persistent or second order or type to excess.
OK, so open up, Kelly.
Going to be rap.
And open access to her blog.
And again, it's a sample page.
So it looks just like a comment page and you can add and delete your entries.
So let's check in here to show all the entries from the other users as well.
And here you can see that comments are listed just like this.
So you can view someone else's comments also.
Let's view this horse page.
Doesn't look like there's anything suspicious in the source.
And the comments are listed in a table.
OK, so now I'm going to do the same thing that we did for reflected excess has.
I'll first try to add HTML tags, so Paiste HTML each one tag and submit.
And it works.
And paste an HTML link and then submit.
It also works.
OK, so view page source.
And you see, the HTML tags I entered are lying in the source.
They are not escaped, not sanitized, nothing else.
So now over the terminal to see the code.
And this is a code file.
Now, don't confuse this with escarole injection functions, the actual excess, as Jack happens below.
This just prevents you from reforming escarole injections on the same form.
So if the level is low, there's no check and the entry is added to the database.
And this part is reviewing the comments.
So if show all is checked, it will use this Escorial query.
Otherwise, it will use this one.
And after querying the database, according to the security level, it will show the data on the page.
Now, if the level is high, check three is called.
For medium check, for his call and for low, there is no check.
OK, so the best part of these vulnerable applications is this you can view the code and understand
the hacking process better.
So follow me, go to Firefox.
Now, pace, the popular excess, has payload.
And yeah, you guessed it right, document that cookie.
So the script executes and the cookie value is printed.
All right, so this means that we can run JavaScript on the page.
So the next thing to do is collect the session IDs.
And that's why I'm going to pass this payload again.
And remember to open the web developer tool and submit it.
As you watch the web developer tool, the base64 cookie value is sent to the cookie stealer at.
So open the cookie stealer and refresh the page.
And here's the cookie.
OK, so go to the session.
This is our user.
And we're able to get the session, Des.
So now go back to Kelly.
The same change level to medium.
And then just add the same payload again.
Open web developer as well.
And submit.
And now we cannot see the request since the session and two are still wrapped.
So then just right, click on the page and view source.
So now, look, the backstage passes are added in before this sign and double quotes.
And this prevents the JavaScript payload to execute.
So remember, in the code, there is an excess check for function, and that's called for the medium
level.
And this function calls another be built in function and slashes.
So that's why we see these extra slashes here.
Now, in order to bypass this security measure.
There are a few ways, so I'm going to show you just one now.
And I'll serve the actual payload code.
On my host is a script file.
And it is completely the same as the previous payload, except for this script, Tagg's.
All right, so after that, I am just going to call that file from Firefox's.
And so I'm going to pass this payload here.
The source attribute has no single or double quotes.
I'm not going to add them because Dom will normalize this code and add it for me.
OK, so open developer tools and submit.
And look at that, it is done.
First, the page includes the script file for my host.
And then the script executes and sends the cookie value to the steel wrap on my host.
So go to the steel rap and refresh.
And the session value is here.
That's right, this is our user.
OK, so go back to Kelly.
Now, let me summarize what what we did here.
We validated that there is a stored excess vulnerability on the target application.
And why is it stored because of payloads we provide are stored at the back end in a database.
So here's a question how can we exploit such a vulnerability to collect the session ID for users?
The answer is we don't need to do anything because we already have.
So we injected the excess payload into the page and now it is stored in the database.
So any user visits his page, our excess payload will automatically execute within their browser.
So I'm going to open Chrome and go to BW.
And I'm going to log in as b web user number to.
And I'm going to visit the storied ex SS page.
And yeah, let me just zoom in here for you, check, show all.
And write something here and submit.
Now, scroll down to see what you display and here's your comment.
Now, have a look, though, some of them are not displayed.
So let's view the page source now.
And scroll down.
All right, so look at here.
All JavaScript payloads that we tried are here in the page, so as soon as this user opens a page,
these payloads are executed in his browser.
Then over this dealer app, refresh the page.
And a new session opens, so go to check out session.
And all right, so perfect, we have the user session value.
See, so this is really cool, huh?
So go back to Firefox.
And I want to show you just a small thing here as well, so set the level to low.
And I'm going to paste this payload and submit.
Now, look here, this is also a way of exploiting the users.
So click this link and it will display multiplatform login screen.
So this is just, you know, a matter of social engineering, little psychology, so I use this simple
login screen, but you can detect and copy other applications of your customers as well and then serve
the HTML interface of these apps to be able to use in social engineering attacks, perhaps against any
of those companies employees.