So we logged into our devoir and we have used the username pass, the username admen and the password
password to get access to our darn vulnerable Web app.
Let's go to the set up and create or reset the database just to make sure that everything is working.
That looks good.
The setup was successful and then come down to the security and we're going to turn that down to low
to get us started.
We'll use low security so that we can try a few different types of attacks.
The first one is going to be a cross site scripting or excess.
Let's click on Cross site scripting reflected.
And I'm doing this from my Microsoft Edge browser for a reason.
This cross site scripting reflected this as the excesses reflected.
Well, let's see how the script works if I say my name is Fred.
And click submit, I can see that this, first of all, does a couple of things, it says Hello, Fred,
and because I'm using low security, it not only reflects Fred to the screen or just prints whatever
I've typed in, it also includes it in the UCLA up here.
So name equals Fred.
What if I said McCain equals Barney and hit enter notice?
I just said hello, Barney.
Well, you can see I've already talked in a script down here.
I'm using the script tag from each to include some JavaScript.
So I've typed in script, so angle bracket scripting, and this is what you mean by cross site scripting,
we're actually going to launch a script in our browser instead of saying my name, they're alert l e
r t open and close parentheses.
Then a semicolon is optional and then we'll do an angle bracket slash script and submit.
And you see that it pops up a window here, the side says, OK.
And it says, hello, why didn't it say a name?
Well, that's because it actually ran this script.
Let's put something different inside that script instead of nothing inside those parentheses.
Let's say, quote, You have been hacked.
Exclamation point, quote, and submit.
And the site says you have been hacked.
Well, it's actually the site that has been hacked just a little bit.
And notice it doesn't say a name down here because it said the script up there.
But I'm going to choose that script and I'm going to highlight that whole thing.
I'm going to.
Control aimed to highlight it all and control see to copy it.
And we have just run a script inside.
A Web page from our Web server, let me go to the excess stored and put a name into Fred or whatever
you like, is the name there.
And you can see that this is going to be a guest book.
So it's going to store this in a database.
So I'm going to paste that script alert and sign the guestbook.
Well, now the site says you have been hacked.
And there's no message under Fred, well, if I click away and then come back restored every time I
come to this page now it's going to say you've been hacked because it's stored that script that I wrote
as my message.
So instead of printing out a comment, every time I come to this page, it's going to tell me I've been
hacked.
Now, that's a pretty simple example here with just this one simple script.
But you could insert a really complex script in here that pops up fake arenavirus that says an attack
has been detected on your computer.
Click here to remove this virus or even worse.
Well, let's see, just one other possibility.
Let's say that instead of letting people see this page, I want to pop up the hacked.
And then instead of an alert, I want to say, let's go ahead and let's copy this.
So I'm going to copy everything that I just typed.
And I'm going to come over to Google Chrome on Windows 10 and try the same thing.
I'll use D.W.I here.
And admin and password.
And I will come to the security.
Said it to low income to the cross site scripting store, see, I'm on a different browser, different
computer even I could be and that is going to be up there.
But if I try to enter that same script here.
And sign the guest book.
It's going to tell me from Chrome that there was unusual code on this page and blocked it.
Well, Chrome is trying to protect us from what it's called reflected cross site scripting.
So if I come back here now says I've been hacked twice, so it protected me when I signed this and submitted
it because Google Chrome and Firefox will both detect that you have submitted a script and it is run
in your browser immediately on the next page.
It's been reflected.
But if I go back to that page, it's going to say you've been hacked several times because all of those
are being stored in the database.
Now, any time you want to clean that database up, you can do that out here just by coming back to
set up and telling it to reset the database.
We don't want to do that yet because we want to see it running on my local computer.
Well, I'm actually going to use my host machine and open up chrome and come to the same server.
10 dot dot three, dot five is my Métis floatable box.
Come to TV w a.
The username is admen and the password is password change your security, Tylo Submit.
And come back to that cross site scripting stored and see it's pulling up all of those.
The site has been hacked.
Well, let's do an even sneakier across site scripting attack and even more possibly damaging attack.
I'll just put a name visitor, but this time I'm going to paste that whole tag.
And instead of that simple alert message inside my script tag here, I'm going to redirect this browser
to a completely different Web page.
That means whenever someone visits this site, they're not going to be able to stay on this page.
It's going to pop up a couple of you've been hacked windows, but it's actually going to redirect their
browser, take them to a different website.
And I could put a hacker Web site.
I could put my own attacking website or something like that in here.
But I'm just going to say one example is window dot location equals and we just need to give it HDB
colon slash, slash, let's say dot com, because there's a limit on the number of characters that this
guestbook will allow.
This should take the user to the general electorate dot com site when they load this page.
So I'm signing the guest book.
Page has been hacked.
The page has been hacked.
Well, now Google, of course, Chrome is saying there's something wrong with this page.
It's detected something unusual.
So we're going to say been hacked.
You've been hacked.
And look at that.
So I reload this page.
So come to cross site scripting.
Stored, hacked, hacked and.
I can't even open the page, it says Hacked, hacked to come to cross site scripting, stored, hacked,
hacked and G.E. loads.
So cross site scripting is real and it can destroy your Web page, your website, your Web application.
Unfortunately, we can do even more complicated things besides just alerts and window dot location and
we can actually set people up for hacking through a company's web page or website.
An easy way to protect against this is to strip tags so that no one can enter tags directly into the
webpage.
We'll talk about that at the very end of this section after we see some sequel injection examples.
Coming up next.