Now, this type of access, as is kind of rare and hard to find.
But it may have the consequences similar to the reflected excess, so basically in this vulnerability,
everything happens in Dum.
These attacks occur when the Web application uses data in the dorm with JavaScript in an unsafe way.
OK, go to Kelly and log in to be Web.
Now, there are different types of excess that are present in this area, but excess as does not appear
here, so I don't know why.
However, it's not a really big deal because we can always import our own dumb excess as example.
So go ahead and download this sample page.
I've coated it and integrated it to work with a BWB security model, so you can just go ahead and import
the page into the BW folder and then use it from there.
OK, so now I'll assume that you've already done this, so open the page to, um, excess dot HP.
And the default level is low, as always, but before going any further, let me explain a couple of
things.
So previously we talked a little bit about Dom, right?
You know, it's like a I don't know, it's like the backstage.
So you see the stage and the show happens out there, but everything is set and controlled from backstage.
Yeah.
So Dom is really the backstage of browser's.
All right, so now what if you're able to find a sink and change some of the sources it backstage,
what happens?
Well, naturally, the show would be affected by this change and Dome SS works a lot like that.
So in this context, a source is JavaScript property that contains data that an attacker could potentially
control.
So an example of a source is location dot search, which reads input from the query string.
And a sink is a function or dumb object that allows JavaScript code execution or the rendering of HTML.
Now, an example of code execution's sync is eval.
And an example of an HD Mensink is document dogsbody, that inner HTML.
OK, so on this page, there are several sources to play with.
I'm going to continue with the first one.
It provides a language selection function.
So choose a language and select the URL will change to this.
Type parameter specifies the source type and the langue parameter defines the chosen language, so view
the source like we always do.
And as you can see, here is JavaScript code.
And it uses the data in the document that you URL source.
So it looks for the langue parameter in the early.
Then uses the decoded value of this parameter in the HTML option tag.
So then this Java code is what you're going to see when you view the source now, there's no way to
understand for me from the source because I chose Spanish.
But if you do view Dom, it differs.
So open the developer tool, then pick dropdown element and look at the code in the inspector tab.
It shows the latest source for the browser to display the chosen language.
So we can determine the chosen language here.
Now, enable Foxe proxy and choose English, then submit.
Berp gets the request very straight and forward.
And the response comes up, so let's look here, there's really no way to understand the German language
directly, right.
But the JavaScript code uses that you are elsewheres and detects the language.
So now let's turn this into a mechanism that will execute scripts for us.
Just add an alert code to the end of the URL.
And yes, it works.
So open web developer and pick the element.
And you see here, this is our payload.
OK, so now we can use our famous payload to send this session and.
And I'm not going to close the developer to.
I'll need to open it again.
And go to the network tab, then paste the payload and hit enter.
And we can observe the cookie value we sent.
So go to the inspector tab.
Pick the drop down menu.
Open these collapsed parts.
And here is the payload that we've entered.
So now open the Stelara.
Refresh the page.
And the first one is the session, and it's coming up.
So go back to Kelly.
OK, so now let's look at different levels.
So changed the medium.
First, juice the sauce again.
Selective language to see parameters, and I'm going to paste this simple JavaScript code and go.
OK, so it doesn't work, but remember, in this level, the script tags are not allowed.
And actually, this phrase is not allowed.
So we need to create another payload.
Open developer, tool pick, yeah, pick the element now here is the option tag.
OK, so now we need to find a way to inject the JavaScript code here to execute.
So we're going to create the payload step by step.
First, complete the opening option tag, then close the option tag.
And then close this electic.
So now we can write our payload without a script tag.
So now I'm going to write this.
And I'll use JavaScript in an event method.
It's not copy it now.
Yeah, I forgot to write something for the rest room.
I think you can handle that.
Yeah.
OK, so I'm going to paste.
But I'll close the tool and paste and then go.
And perfect, the page executes our payload.
Now, exploitation will be up to you.
OK, so now enable Foxe proxy.
And refresh the page.
So this is what it looks like in burb.
And here's our payload sent to the server as well.
So if there is no check in the back end, dumb excess will arise.
So forward all.
And the alert appears.
All right, so the last level, so first choose this source.
So like the language, see the language parameter.
And now we can add here our sample JavaScript payload.
Yes, alerting code.
Oh, nothing happens, so remember the code check to see if the language parameter has one of the languages
in the box.
So we may have a problem.
But have no fear and no worries at all because.
You have also seen the solution, do you remember?
I'll take you through it.
OK, so enabled berp.
Base the payload and go.
We get the request in berp.
And see, the payload is sent to the server and this causes the air and then for the rest.
OK, so let me go back to clear you are Al.
And now I can paste the same payload here.
And the way to send this payload to the server may not be obvious.
But there is a way.
So just put a pound symbol here.
And the rest after this symbol won't be sent to the server.
So let's hit enter to see look at berp.
And the payload is not in the request forward and let it all go.
And the alert message appears.
And once again, I will leave the exploitation up to you.