So, as you know that we have increased the security level too arrogant.
Now if I drive Alcmene and password as single code, it says dangerous characters detected OK, which
means it is filtering out these kind of characters so we are not able to use as fuel injection here.
Now, we are not sure whether the filtering is happening on the client side or on the server side.
So to find it out, we are going to use both.
Sweet.
OK, so by proxy will help us to determine whether the filtering is happening on the client side or
on the server side.
So here is the or simply click this and it will open.
Here it is right now.
The function of batsuit is whenever we try to load any website using a browser, the request for us
to go to our website and once we forward the request, only then we will able to access to that website.
Right now, let's see what I mean by that.
So if you try to access Mattilda homepage right now, it's running.
OK, so we have to perform some changes in security settings.
So go to be friends and their friends.
We have to search for exwife that is Nego proxy.
Go to settings.
And now here simply click on Menville proxy configuration, enter the local IP here and both numbers
would be eighty eighty click on OK.
Right now let's try to reload the page.
OK, this time it's rating.
So let's switch to Bob.
OK, here we received the request, now let's forward this request.
Right now, let's switch back to our browser and you can see that the home page is open now, right?
So let's go to login page again.
Again, we have to go to Buckfast and forward the request, only then we will able to get our login
page.
Now.
As you know, if I type any of the ESKIL injection, it says dangerous, get it detected, but if I
typed in Bulbasaur like ABCDE, OK and hit enter, nothing happens, OK?
You were not able to see error like bad characters and all.
OK, but still this password is not correct.
So let's see how we can bypass this.
So OK, it is waiting for the request to forward in bulk.
So let's forward this request and see it is bad username and password OK.
Which is authentication error.
It is not filtering out the simple characters.
Right.
So now let's see this time we use Eskil injection.
I'm using single and hit enter.
So see this request is not going on Boxwood, which means it is filtering out the dangerous characters
on the web page itself.
OK, before sending it to the boat, which means the filtering is happening on the claim side and not
on the server side.
So let's see how we can bypass this.
So let's take the simple password fake ABCDs F hit enter and let's switch to Bob now here.
Don't forward the request to go to bed, OK?
We just barometer's and here is the password.
OK, so let's change the password to the previous one which we have using the previous Videojet, this
one.
So let's copy this and paste the password here.
OK, now forward the request.
OK, forward again.
Now let's switch back to browser and you will see that we are successfully logged in as admin.
Right.