Welcome to a video lecture in this video we will discuss how to perform manual text based or it's using
but search repeater when performing a publication Pender's think there will often be times that man
with testing is required to export a given one an ability capturing every response in the proxy.
Manipulating it and then forwarding it can be become very time consuming.
But the repeater feature simplifies this by allowing consistent manipulation and submission of single
request without having to region read the traffic in the browser each time but rebuilders simply works
by providing a text based interface to the web that repeater can allow a user to interact with remote
web services by directly manipulating requests rather than interacting with their web browser.
This can be useful when testing cases for which the I tune in Steimle output is more critical than the
way it is rendered in the browser.
Let's open a browser.
Click on Access's reflected now on my intercept proxy on search ABC any random string
to use but certainly better requests need to be sent to it from either Android capture via an intercept
or from the proxy history.
The easiest way to start working with the repeater is to select the request you want to work on within
and above to right click on the request and use the send to repeater option to the context menu by shortcut
key control press.
It also can send to repeater to.
This will create a new request in a repeater and that dramatically populate the target that is and request
method editor with the relevant dates.
You can modify an issue the requests as required.
Here you can see that repeater UI lets you work on multiple different requests simultaneously each in
its own depth.
When you send requests to the printer each one is offered in its own numbered that using the request
as to leave a message editor you can edit the request and reissue it over and or the big message editor
showing the response that was received from the last request when your request is to send.
Click the go button to send it to the server.
The response is displayed.
When this is received together with the response land and add time in milliseconds you can use the usual
SCDP method a function to help analyze the request and response messages and carry out further actions.
Their request is made for the user to provide and name and insurgents the provided in put in the estimators
points to test for the possibility of process scripting which should first inject a series of commonly
used characters in such an attack.
After sending indices of characters we can see that all of the characters were written in the extremal
content and none may escape.
This is very strong indication that function is vulnerable to cross-eyed scripting.
We can enter the standard token request for a script alert high enclosing script tag.
Now let's see the returning Steimle content
we can see that the opening script closing tags have been included in the response.
This can be confirmed by issuing the request in a browser.
Now let's evaluate the response in the client browser by clicking on the request and then select the
question browser.
This will generate a word that can be used to police you the request in a browser that is actively connected
to birth proxy.
We can copy the UI provided manually or by clicking on the copy button.
This Eurail can be pasted into the browser and the request will be issued in the browser assuming the
cross-site scripting attacks are successful that landside jousted code will be rendered in the browser.
But we are not getting the alert message because I am using Chrome.
It has default protection against reflective access as attacks.
Good.
That's all of the repeater tool.
Thank you and see you in next lecture.