In this video, I will teach you how you can automate the task of Crosseyed scripting attacks, right.
In the previous videos, we have seen how we can use Access's attacks manually.
Now, this time we will see how we can use it automatically.
So for this, I am using colonics and I'm using a tool called Batsuit.
Now, I hope you all remember that in my previous videos, when I am explaining a skill in attacks,
I have used the same tool to bypass Glenside cybersecurity right now.
This time we will use this tool to automate the process of attacking on a website.
OK, using payloads.
Let's configure our browser.
So in Cali, we will get fired for so let's open our browser.
Go to preferences.
And then go to L.A. and then to network them, right, and then go to settings.
And in settings, we have to enter the IP address of localhost, so it would be.
One is seven, dot or dot, dot, dot, one and board number would be eight zero eight zero and click
on.
And close this.
OK, so now.
Our browser is ready to use batsuit.
OK, so let's switch to batsuit.
So now bobsled is running, so let's switch to our browser and let's try to open our website.
So website would be best BHB dot one, the web.
OK, now let's switch to batsuit again.
Go to proxy and send this request to spider, so click on Send to Spider.
OK, click yes.
And make intercept of.
OK, now let's switch to Target.
OK, so here is our website, and the spider is crawling all of the pages and will tell you that which
of these pages will help input parameters.
OK.
So to fill out the reserves, double click on Barometer's so one and two.
OK, so these are the number of you are quite a number of pages on a website.
Vittel input parameters.
Right.
So you have to try your payload attacks on each of these Web pages.
OK, so let's try this one.
OK.
It says guestbook dot bhb.
So right.
Click and click on to reporter.
OK.
And now let's switch to the Twitter.
See the job of Spider is to crawl out of the pages from a web website.
Right.
And then it will tell us that which of these pages have input parameters.
And once we found we have to send each of a page to.
OK, now we are here on Rippetoe.
So let's check which of the input parameter is available.
So we have to input parameters.
This would be the first one.
So let's try helo one and this would be the second one.
OK, so let's try.
Hello to again click on Go.
And here we have a reflection of this Web page.
So let's check whether we have hello or not.
OK, so we have got one, which means the first input barometer is vulnerable.
OK, once we got this.
Now we have to send this to intruder in the interactive.
It will help us to perform payload attacks.
OK, so here in the options in the payload, first we have to add some payloads.
OK, so if you're able to see let me show you here on my desktop.
That I have a file called Exercice Payloads.
OK, so this particular file will contain hundreds of payloads.
OK, so there is no need to check all of them one by one manually.
Right.
So to save our time, load that file here in boxset.
OK, so the file would be on deck.
Stop and let us open the file in bobsled.
OK, so this much of the script is available in that file.
OK.
Right now.
OK, now we're in position, Steib, first you had to clear all of the selected items and then select
the particular input parameter on which you want to perform the attack.
OK, so I want to perform the attack on input parameter one on one.
So select this and click on ADD.
OK, Brunsdon, my previous virtual machine is working very slow, so I decided to boot up another colonics
virtual machine.
Don't worry, all of the settings will be same as earlier.
OK, so all set.
Simply click on stop attack.
OK, click.
OK, and now we just have to wait until it finishes using all of the payloads.
Now here, keep in mind one thing.
When the requestor payload is set to zero, so this length which is five five eight one, is the original
length of a webpage.
OK, so the length more than this.
OK, like this and this.
So all these links or all these payloads are working on that web page.
OK, and the size below this.
So there are more chances that this will not work.
OK, so whenever you want to try any payload to try the payload, which has lent more than this.
OK, so let's try this one right.
Click and click on short response in browser.
OK, click on copy, switch to Firefox, ok, and paste the copied.
You are in here and hit enter.
OK, now we have to wait and it will show us the response.
See Accessors attack is working here.
OK, so our payload is working right.
So this way you can automate the task.
OK, so let's try one more.
Let's say this script, let's try this one as well.
Click on show response in browser.
Copy this.
OK, switch to Firefox and based in the United hit enter.
See it worked right.
So this way you will know which of your script or payloads are working on which of the web page of a
website.
Right.
So it would be going to save you a lot of time and energy.
OK, so this is the easiest way of performing your script or your payload attacks on a webpage automatically.