OK, so another Web application venerability that's very common.
We're going to look into is Crosseyed scripting and you're going to commonly see this witness exercise.
So Croci scripting Mirabilis or some of the most common reliabilities that exist in Web apps.
And there are three types of them.
So first, the historic CROSSEYED scripting, which is where malicious code is actually stored inside
a Web page.
Every time that page is loaded, this malicious code actually executes then is reflected crosseyed scripting,
which is where this malicious code is actually executed via visiting like a specific you URL that's
crafted to execute, you know, that code.
It's kind of similar to cross site request forgery.
And then there's Donbass across a script in which is less common typically, but it's within DOM environment
of the browser is actually modified and makes the page load in an unexpected manner, they say.
So crosseyed scripting are typically just involves injecting malicious code into the request for a web
page or into the Web page itself.
And that leads to a being executed when that page is loaded.
When that request is made and you know it's possible because the scripting is only possible when input
that's given to a app is accepted without being sanitized properly first.
And Crosseyed scripting is very commonly used to redirect users to like a malicious link and one of
the forms of crosshatch scripting that we're going to do, as well as called content injection.
So it's like a sneaky way to conduct is like the stored crosseyed scripting what it is called containerisation.
So instead of redirecting to another site, we just inject links in the pages that we direct users to,
which then executes the payload.
So we're going to see kind of like an example of this as well.
OK, so we're at our reflecting Crosseyed scripting page.
We have our security levels at the low for now and let's try to see if we can do some crosseyed scripting.
So let's look at the source code for this first.
So this source code just once again, just code and is just echo is taking in what you're putting like
is asking for your name and then it's saying hello and then just putting what is rendering whatever
was passed in as name as HTML on the page.
So this is bad because it's not checking the code to make sure that you know, any malicious, any malicious
characters we use or any malicious code is inside of it.
So we can potentially take advantage of this.
So I would use it as as you know, as intended.
What's your name?
Anthony.
There we go.
So it says Hello, Anthony.
OK, cool.
So we know that whatever we type in there is going to render in HTML on this page.
So one thing that we can do is try to to test for crosseyed scripting on web apps.
You want to take these kind of boxes where you can submit things and try to see if you can get some
JavaScript to actually load.
So what we're going to do JavaScript just scripting language that's used for like, you know, having
dynamic Web pages, pretty much very, very common use pretty much everywhere on websites.
So there's something called the alert.
So to start a JavaScript, you know, line of JavaScript code.
So all we have to do is actually do the two less than the arrows and type in script.
And then that's going to be that's the start of a script.
It's kind of HMO like where you have like the body tag.
So this is starting the script.
So then what we're going to do is we're going to use the alert function.
And what this does is just pops up with like a text box.
That says whatever you put inside of the parentheses here, so we're going to put hello?
I just got hacked.
Hash tag, cross site scripting.
There we go.
Cool.
And then after you know, after we put that, we want to close the tag just like HMO.
So this is just going to be this the to the less than agree the area again.
And then it's going to be a four slash and then it's just a movie script.
And so we have that in there.
So this submit this and see if you know crosseyed scripting is actually possible.
So, bam!
OK, so we hit it and now, like I said before, it takes what we put into the box and actually renders
an e-mail.
So if you put JavaScript into an e-mail page and JavaScript is going to execute.
So it actually executed that alert script.
So I just got hacked hashtag crosseyed scripting.
So knowing this, we can actually point, you know, to a malicious script, you know, on our machine.
So what we can do is I actually have a file, I call it Poun Digest.
So this is the same JavaScript file.
You just give it the dog's extension at the end so we can go ahead and do this right here.
So bam.
So this is a very, very basic JavaScript file.
So we're creating a function just like other languages, you know, when you create functions or function
the functions called IMG.
So pretty much it's creating a variable right here called IMG stands for image and it's creating an
image element inside the page.
And this we're putting the source of the image to be our Caleigh machine.
So this is the address of our machine over this port seven three three one.
And then on top of that, we're adding the the cookie that's inside of the browser.
And what this is going to do.
So if someone were to execute this function, it's going to connect our to our machine over this port
and it's going to also copy the cookie over so we can actually steal their cookie if they were to execute,
you know, this code.
And then it's going to depend upon what this creation to the the page to the same page.
And I just put this alert right here, just, you know, just for testing debugging purposes and testing
purposes, just to see if the code works.
So if it works properly, it should probably this box right here when is executed, this is our script
executed.
And then outside of that function, you go you have to call the function.
So we call HMG, then we should be good to go.
So I have to do is create this file.
Then we just do a quick.
And one thing we have to do, and this might be a little bit new for you as well, another way we have
to host an on a Web server and we can do that with Python.
We usually did a party just to do it, report 80 by default, but we can do it with Python over whatever
port that we want, wherever we want.
So we're going to use Python three and then we're going to type dash em because we're going to be loading
this modules.
So HGP server and then they say seven three three one, because that is what we have inside of our file
and that's what someone's going to try to connect to us over.
So what this is going to do when I enter is going to start a Web server or report seven three three
one, just like we have a report 80.
But the root directory is the current directory that we're in.
So now we see that we're serving SCDP, you know, on Port seven three three one.
So someone can connect to us over that port if they're worth Brouse to it in the browser.
So now our Web server is starting.
So all we have to do is actually go back to the application.
So what we're going to want to do here and you're going to see why is reflected in a minute.
Just note that everything that we're putting, you know, into the name box is being passed into the
URL.
So someone goes and executes the world that we put here.
It will do, you know, execute whatever scripts that we put into it.
So what we can do is craft this to where he's actually going to execute upon that Jayasekara.
So all we have to do is just just like we did before we did the script tag and then do we could do a
source attribute inside of it and put the source as our colleague machine over Port seven three three
one and then the phone and then point to the phone, that jazz script.
So what this is going to do is actually execute that script when this is loaded.
So let's go ahead and submit.
And as we see remember from the script, we put that alert in there just to make sure that it works.
So we know that it executed successfully, says we see this pop over here.
So all we really have to do is get someone to browse to this.
You are right here.
And then we'd be able to steal that cookie.
And as you can see right here now, we have their cookie right here.
So we can actually use that to maybe take advantage of their session.
So and that's how you do crosseyed scripting.
So it's very, very neat and very useful, you know, vulnerability if you're trying to exploit the
website.
So I definitely think that you guys should look into crosscutting getting a little bit more so.
Now, let's move on to start scripting, OK, so if a store across our scripting, like I said before,
this is a we can inject malicious code into the page and every time that page is loaded, it will load.
You know, they will execute that that malicious code.
So let's see if we were to use this as intended, you know, just be, you know, a name.
Anthony, hey, I'm going to hack you a new job and then we sign the guestbook and now it pops up right
there.
So we know that is a pending this data to the page.
And if we look at the source code of the page, it's not doing any checks for the most part to make
sure that it's not using any, you know, malicious characters I can use for crosseyed scripting.
So what we can do is actually just take advantage of this so way that we can once again just test for
it.
We need to do Anthony right there and then we can just put a script and we could do alert again.
So let's see script.
And then there's two alerts.
And this time we're going to say this won't go away.
There you go, bam.
And then let's close out the script and then all we have to do.
Is his song, guest book, and now this won't go away, that popped up because the page reloaded.
So if we go and actually reload the page again or actually we just click on this right here is going
to pop every time.
So imagine if you are to sort of like a malicious script.
If you were to find this vulnerability on a website or by that you would insert a malicious script that
maybe steals cookies or excuse some malicious code and gets into somebody's computer browser and you
can do whatever you want.
So you can use that.
You can link out to that poster and actually once again and actually get to like actually get their
cookie.
And you can do a lot of other things as well.
So that's just the different types of crosseyed scripting right there.
So it's pretty neat, pretty fun to exploit.
OK, so now we know how to perform web application penetration testing.
So what's next?
So now we're going to go over we're going to, you know, dial it back a little bit and go over some
mobile security topics just to help you stay still, stay safe on your mobile devices and help you guys
just not get hacked.
So I appreciate you guys for listening to this bar.
And I'll see you guys in the next section.