Welcome to our video lecture.
In this lecture we will see that how the exercise of a latter day found in the reflected searches that
form input
for this demonstration.
I will use orderly ISP mutual today to a broken web application before going to start fresh and sure
that Bob is correctly configured with your browser let's open up access DNS lookup page to test for
excesses were lab D
let me check how this web page will men's behavior of this page what I am going to do is let such DNS
look up for Google dot com type Google dot com and hit submit here you will see or hear that we get
search results in this cause we have not concentrated on DNS look up results you can see or hear that
deserted far Google dot com.
So let me inspect this page
OK.
Here you can see that division tag that's for Google dot com he had not Jason on nothing it is directly
displaying so Google dot com is searchable.
Suppose if the search item is not found it is this thing the same so let's check it once.
Check for random item here you can see that it is.
Same here for this accesses.
We don't have any problem right.
So let me open up Bob and intercept is on
search item.
Here you can see that Bob is intercepting the strategic request.
This is the post request action for you are.
And so on.
So I will send it to Peter for an ally's request and response side by side click on Burma bar tab we
can input various access payloads into the input field.
So what I'm going to do is I will add one simple exercise payload as open script allowed access as
closing script this example we have used a payload that attempts to perform a proof of concept pop up
in our browser now click on go button here you can see oh I hear that in this box we can assess whether
the attack payload appears unmodified in the response if it exists this means that application is vulnerable
to accesses you can find the response quickly using the search bar at the bottom the response spanner
the highlighted text is the exact offer search so right click on the response to bring up the context
menu click show response in browser to copy the you are in click copy
now pasting copy it you are in the browser here you can see that we have successfully injected javascript
into the web application it simple line in the next lecture we will try with a DV w a one level app
it check all the security levels for excessive similarity if you have any doubt on this lecture I will
update as a lecture with by passing the estimate text to run our javascript thank you for watching.
See you in next class.