Now it's time to perform the practical of exercise.
OK, but first of all, you must follow some steps.
So the first step to follow is find an input barometer, type anything, dear.
And if you get a reply, then there may be excesses.
And to confirm it, you have to inject JavaScript code there.
And if you succeed, then there must be an excess vulnerability.
OK, now what I mean by input parameter input parameter could be your search bar or the user name and
password fields you've generally found on the login page or all of the fields you found on site, the
page or your contact us page on forms or coming boxes, etc..
Now let's try to perform exercise attacks on my Web site.
So here is a website which is test BHP dot villa dot com.
OK, now this website is intentionally created vulnerable to their attacks so that students like you
can perform a skill injection attacks or crosshatch scripting attacks on websites.
Right.
And this website is running on Apache Web server and is built on BHP programming.
Language and database is minuscule.
OK, to no other leaders.
Visit the homepage of this website and you will find other information here.
OK, so this would be the year in which we are using.
Now, let's close this box, OK?
And let us input anything here.
Let's say hello.
OK, so you can see it is reflecting.
Go back.
Hello.
OK, now let's try to inject a JavaScript code so I will use a common script which is a script alert
and let's say one, two, three and then script cryptic clues hit, enter and see.
So there is a accessors vulnerability here.
OK, now you can try this on other pages as well, like browse categories.
OK, let's go to posters and let's say coming down this picture now here you will find two boxes.
OK, so we are not sure about which one is believable.
So let's try hello one.
And here, let's say hello to and let's see which one will reflect back.
It says hello and thank you for the comment, OK.
That means the first feel is vulnerable.
OK, now to make sure we have to run a script again.
So script alert and let's say one, two, three and again closed the deck.
OK, and here anything which you like and click on submit.
See it is also vulnerable.
Now let's move to sign a bit.
Now I personally know that this is not a vulnerable OK, so I don't want to waste your time.
Let me jump in a bit, OK?
And let's try one of these.
So let's say hello one, OK.
And hello to and to retake password we have to use hello to then in the nymphal we will use let's say
the name would be A.B.C. again.
Good go.
No it would be anything like one, two, three, four, five, six.
Then the email address which would be hello and direct.
Hello.
Dotcom and the phone number would be anything like nine nine nine nine nine eight seven, six, five,
four.
OK, and in the address, let's say hello three, OK.
And click on Sign Up and you will see that all of these fields are vulnerable right now.
You have to try to inject JavaScript code on all of them right now.
I hope you know about the basic attack of Crosseyed scripting.
Right.
So now let's try this attack on a Web site.
So let's say would land worldwide dot com.
Let's go to search bar and let's stay here.
Hey.
And see whether it is affecting or not.
OK, this is not a cell phone, but see, OK, it's reflecting this world.
Now let's go yet again and let's try to run the script alert and one, two, three.
OK, hit enter.
OK, you say suspected excesses attacked, this beach has been blocked by nightfall.
I am using Nechvatal, whatever it is, blocking this bit, but click on visit anyway and see if it
is vulnerable.
OK, so this is a Web site, right?
Now you have some more details to visit, you can try them by yourself and in the next video, I will
increase the level of exercise attack.