In the last lecture, we had a brief overview of this practical, but we exploit that vulnerability
at a very low level of security.
Now, in today's life, the applications might not have that level of security.
So let us see how we can exploit this attack at a medium level security.
Now, I will login to my colleague machine and then start the machine, but I won't show you the exact
all the process again and again.
So just make sure that you are logged into your DVD player, which is installing candy machine.
Again, we are not using the metastable here.
We are using the unbelievably solid force.
Before we start, just go to set up RESAY database before you start in the practical to make sure you
scroll down and click create a reserve database.
That's it.
Now go to security.
And set the security to medium.
And then let us this time use as reflected, so what's your name, let us type Mark and let's see how
it is getting reflected.
OK, now let us try to inject each injection.
So let's just type B so we can see the market is getting bold, which means that each injection is working.
Now, let us type of the ATM tag on it is now in the script tag here.
So I just type underscore script.
Alert one to check whether.
This script is working.
And let us click submit.
OK, now we didn't get Texases alert, it is showing alert one.
Now, why it is doing like that, why it is not accepting the script.
Let us see the page source if you maximize it.
Is there any input?
Yes.
If name exists, then go to the next step.
Now the next line that is Dollard name is equal to string replace.
There is a catch what the source code is doing.
It is if it identifies the script tag, it is replacing that with a blank piece you can see.
Dahler name is equal to string underscore replace in open brackets script, comma, blank, comma Dahler
get name.
Therefore, it is just removing a script tag.
Now we know that it is removing the script tag, let us see if we can either try using the script again,
another differently.
We all know that JavaScript is case sensitive but are not case sensitive.
And in this case, script here is working as an HTML tag.
Therefore, we can just try different alphabet in uppercase and lowercase and let us see if that works.
Now just hit submit and it should probably work.
There you go.
We have got one, which means that the program is just removing the specified characters.
So let us try to get document, not Cookie, if we can retrieve that also.
Instead of one, let us write document that cookie and we should get decision idea as well.
There you go.
We have got the S.A.T. Now, as a security expert, you should be able to identify what must be the
code that is that is used to secure.
So let's again go to the page source.
Sorry, Alex, again, go to the source code.
And now in that place that is accepting the input.
Yes.
At that place, it should not just remove the script tag.
What it should do is it should individually scan the string and it should remove the characters SCIRI
party, whether in uppercase or lowercase.
It should also remove all the brackets that is opening brackets, opening and closing angular bracket.
In this way, as a security expert, you should know how to secure the court.
This practice is known as securing coding, and therefore we always tell students that you should always
have the basic knowledge of JavaScript, HTML and data structures and how to basically code.
So this was how we exploded the excesses vulnerability at a medium level.
Now you can also write the same story as the difference is that the script will get stolen in the next
lecture.
We will try to exploit the highest level of CROSSEYED scripting and I will again show you some different
methods to do that.
I will see you in the next lecture.