Welcome to our video lecture.
In this lecture we will talk about how the exercise for anonymity in our real life and how to prevent
them.
Let me explain the process and the impact with an example imagine that it is a Sunday morning and you
receive a call from your mother.
Mom is so scared because all the money in her bank account has been stolen you as a good son and to
the online bank application and remove the account when you see all is correct.
But there is a transaction that more all the money to either account when your mother calls the bank
the bank.
Just answer that.
This transaction was executed with her valid credentials and is not possible to do anything because
all is correct.
Now the question arises How did this happen.
You discover that a day ago she received a message by email from the bank to win a vacation in Paris
she allowed into the website and following the recommendation that you as a security expert gave to
her.
She checked in the web browsers address but that the bank's domain was correct.
She called the bank again to confirm this promotion but the assistant tells her that no one in the bank
knows about the promotion.
You know what happened now.
Your mother was the victim of a reflected excesses sent by e-mail to steal the credentials of her bank
account reflected access as either type of exercise that is executed at the moment.
Mostly it affects get requests if you mind.
The email received by your mother.
You can see that the email contains a link to the promotion this link includes divided banks domain
name something like this here.
W w dot bank and the score domain dot coms less access.
Question mark account because to then single code script alert and blah blah the value assigned to the
variable does not appear like an account number.
It actually is a javascript code you can identify it by the script tag which is the tag used in estimate
to insert a code script.
Now you can infer that the account variable is vulnerable.
It has a lack of input validation that allowed an attacker to inject javascript code and send a lot
of emails with the malicious link to people in order to execute the attack.
This is the reason why this type of exercise is called First Order.
But if you enter the real world without using the malicious thing you will not see the attack.
The attack just affects the user who is clicking the link whenever you get spam emails don't click on
the links without verifying check it once.
Is this link contains JavaScript or not.
Some links will redirect to malicious websites or malware download links.
OK.
Thank you.
See you in next lecture.