Come back in this video lecture we will see cross-site scripting or were you grassers the penguin that
pretty insect Landsat attack.
And it's most popularly card as Access's so cross scripting what inanity is often found in a lot of
obligacion especially where a user provides input receiving areas like search farms and farewelled farms.
If they use supply input is actually being executed by the web application which means that web application
is cross-site scripting will not have
no user provides javascript code instead of providing a legitimate text.
And if the javascript code is being executed by the location which means that web application is cross-site
scripting whenever he can also be used and in order to streamline EULA cookies session is uneven.
It can also lead to CSA for tags so cross-site scripting is off great as
the first one is reflected crosshatch scripting.
And the second one is Tor cross that tipping and third one is done based across scripting.
Now lets talk about both of them in much more detail.
Reflektor cross-site scripting is also called as non-persons turn crosshatch scripting because here
the user input is not stored in the database which means if the user input is not stored in the database
the response of the real application is only shown to the user who is actually injecting the javascript.
Which means if we are injecting something in search bar or our gyroscope is being executed by that application
which means the response of that Javascript can only be shown to us not anyone else because the input
is not stored in the database and often found in the search bar.
Now let's talk about stored process scripting.
So Star-Crossed sidestepping as so-called as stored access and pusses and access.
Why.
Because the user input is Dorton database.
And when the user input is stored in the database then they are just for example there is one comment
section and we commented out a javascript query and in place of command we added javascript queries
and we will click on submit anyone with a database.
Then the jousted also being executed on that user which means the impact of store grassers the ping
is much more than non-persistent crasser scripting.
And then it can also lead to CSA for that.
Now lets see that Donbass process Tripti numbers access access simply means crosshatch the penguin notability
that appears in the no means document object model instead of part of the extremal in effect do and
store classers scripting that as you can see they will never the payload in the response page but in
don't base across or scripting their statements or scold and response of attack will be exactly the
same.
Thats out of our taxes.
Thanks for watching.
I'll see you in next class.