Let us start exporting the cross site, scripting vulnerability in a machine in the previous two lectures.
We saw the theoretical explanation of Crosseyed scripting and we also saw the working of crosshatch
scripting.
But to understand the working, we also need to understand how exercise works and therefore we start
started the practicals of exercises we have already seen.
How do we install the time when the real application in the Karlee Linux penetration testing lab set
up S..
So for these lectures and for the remaining lectures, we will use the degree to which is installed
in the Linux.
You won't be needing the portable virtual machine.
So let us login into our candy machine.
So as you can see right now on my screen, forced to launch the device, we should open terminal.
And as you start the services, so just type pseudo.
Service.
About to start.
Enter the password.
Then type pseudo service might start if you do not start these services, you won't be able to run their
debatably on your local machine hit and.
And that's it now minimize close it, minimize the terminal.
Go to your browser.
It is Volvox.
And then in the U.S., we have seen how to start to develop, that is one twenty seven point zero point
zero point one slash divi W.T. in.
And then hit enter login with the default username and password that is admin and password.
Now, you can see this is different than the vulnerable in metallurgical machine, so we use there are
other features like insecure capture, normal injection vexation, etc. So first go to develop security
and set the security to low, because in this lecture we are going to see the working of Exercice.
So just go to Xerces Store.
We'll be exploring the story and really you can try it on anything.
So before doing anything, clear the guestbook so that it becomes really handy.
So now you can see on the screen that it is asking for name and message.
Let's first put Mark as a name and just put hello in the message.
Let us see how it is getting reflected.
You can see we can see the characters as it is now, since I'm a security expert, I will try to input
some different characters.
I will just enter, let's say.
Brackets and in the message, I will enter hello.
Well, the brackets are there as it is, so right now, let us try to insert a double injection, so
just insert dash B.
And in type Mark and then close the B deck.
Now, you might not be able to close the tab because as you can see, it is not allowing us to just
right.
Click the name and click inspect element.
You can you can go to the name tab, just click there and you can see the maximum length extent, therefore
it is only allowing 10 characters change to, let's say, one hundred and close the inspector up and
now close the big.
And in the message type something, hello.
Just click sign guestbook.
There you go.
We can see that Mark is bold, which means that the name Inpart is accepting the script XHTML script.
Now, since it accepted Actimel script, I might guess that it will accept my JavaScript also, but
that wasn't the name tag.
I want to see whether it is accepting the script in message.
So in name just type mark and now type bold in message.
So be and type some the message of your choice.
They just hello, you you hacked.
And then I will see whether the injection is working or not.
And then I will just sign the guestbook.
There you go.
It is also accepting the Ekdahl injection in the message that so the just type mark in the name and
now it's time to exploit the vulnerability that is exercice.
So write script.
Now, if you do not know how JavaScript works, you have to learn the fundamentals of JavaScript, because
in this lecture, in this whole course, we are not currently going to teach the JavaScript fundamentals.
You should be you should have just a basic knowledge of what is script or text.
So this is how you write a script.
And let me tell you that this is the most basic script which is used to test Exercice, and it is also
used by many penetration testers as well.
So just click sign guestbook.
There you go.
We can see on the screen that we have got one, which means it is injectable Texases, so let us try
to find out, get the cookie.
So in the name type market in the message, the best way to find out a cookie is to get through alerts
to just type alert in open brackets.
Document dalkowski, everything should be lowercase, document that cookie.
Close the bracket and also close the script that we should get the session ID here and just click sign
guestbook, they go.
We have got Decision Irey and Security also.
Yes, click.
OK, so now if we are able to get decision, Eileen, on getting such an I.D., one of the most important
hack and hacker could do because of why I say you can impersonate and you can tell a server that you
are actually Mark.
So whenever you try to login and let's say you forgot the password, you click forgot password and then
you use both so you can replace YACKETY with this cookie and therefore the server.
Revalidate that, OK, this computer is valid and you are.
So this is important and I do not clear the guestbook.
I will show you what is the example of store exercice.
So again, just type the name Mark.
And in the message type alert, you are HACCP.
Script alert.
You are being asked.
Right, you were hacked.
Now, you might get the story exercice.
Before clicking sign, let us guess, I'm guessing that I will get your message, let us see what we
get.
Click Sign Guestbook.
What a court decision, S.A.T. Lecoq.
And then we got your hacked, I will tell you why.
The first message in the comment box is the mark.
And at the first time we got the session and the second time inputted our message.
We were asked are we were told it also were to tell us your had the first script of session.
I got already stored on the database and whenever I again tried to inject some script, it showed me
the first result and the second reason as well.
So this is how I across the scripting works.
Basically, it stores the script permanently on the database.
Now suppose let's say our constructor just tries to go in and there he enters some script and let's
say he does something.
One, two, three.
And whenever he does that, he will also get all the results.
Let's see that.
Now, let's say he or she is entering something.
Let's introduce with the constructor and let's to help.
Just as in Brooklyn, hello, click sign guestbook.
There you go again, court decision idee.
Because you are hacked and then he got his message.
So this is how store accesses when that works, basically it stores the scripts that are on the database
server.
From this, you might have got an idea that if such a vulnerability is exploited or it is identified
by the hacker, he can take benefit by injecting malicious scripts and he can get the entire credentials
of the database.
So this is how exercise works.
And we also saw what is stored across scripting, whereas in case of Reflektor crosseyed scripting,
it just reflects the message.
And there you go.
You do not have to get stolen.
So this is how it works in case of Reflektor, because you have got Hellerman, that's it.
It doesn't get stolen.
Let's take another name there.
It's type B, Mark.
Let's see if that works.
Yes, it got bolder.
So did we see the earlier message of Mark?
No, we just saw the bold message.
This is the major difference between reflective excesses and excesses that led us to try alert 10 and
will close the script tag.
Let's see what we get, they go, we got 10, but did we see the mark, which was bold?
No, this is how reflective exercise works, basically doesn't store the script, but in case of exercise,
it just stores the script.
That's it for in this lecture, we saw how we exploited the excesses at Ameliorative at a low level.
Pardon me.
In the next lecture we will try to exploit Exercice story in the medium level will never really let
us see if we can do that and we will see the different techniques used by hackers.
Exploit exercice.