Hello, welcome back to section. 3 2
Section 3 is a Hands-On module in
which we'll be taking a look at the different. Use case scenarios and
different payloads articles used in order
to perform session, hijacking. So let's get
started with the first attack. This is known
as cookie hijacking via cross-site scripting.
So typically, in order to perform this attack, you
would need a vulnerable web site, which is
impacted by reflected, plus XK.
Even though we will not deep dive into, what is reflected across a scripting in
just take an overview. So, typically in
this sort of attack, what really happens is that the
value that is being submitted to the web website. It's
actually passed as it is without sanitizing, the
input against any malicious content, and it will
be added as part of the HTML, document itself.
Unless and until it is malicious. They may not be in a Major Impact.
But in case of the scenarios where
the input is, somebody's JavaScript, it will be appended
to the HTML document itself and we to be executed. Now,
let's take a look at the hands on.
so, this is
a dummy website that I've created for demo purpose, only.
So in this particular scenario, we have a variable in
the get parameter error, that is actually
one Rebel to the critical size scripting. So
let's take a look. How does this work?
So, whatever values I would be able to pass on this parameter. It
will be actually reflected.
So as you see whatever, I have type it is fast
as it is. Now, let's think of something much
more malicious.
So long as we can see that actually we
see up from an alert that is generated
because of the script that we have provided with
you.
So, let's take a look at the source code also.
So, as we see the malicious script as been appended to
the content of the body.
Due to this while rendering HTML document,
you'll actually parse step-by-step. And
when it reaches the Melissa JavaScript, it will also gets
executed.
So, let's quickly jump out the developer tool.
Also.
So as we can see, we have a
PHP session already been generated once we visited the website.
So now let's perform
some more payloads, which can
actually take out the cookie value.
So, instead of alert director one. I'm
just trying to use the JavaScript command document
dot cookie.
So what is cool too? Is that it's going to parse the document that
is a website and the cookie dough is being generated.
So, as we can see, the particular PHP value has been
alerted. So as
you can see the impact because of an another,
the best attack that is cross-site scripting. This
attack is actually leverage in order to hijack sessions. So
by hijacking, that means attacker has
to take this particular value and
actually use it on its own browser.
So, how can we actually do that?
So what are the common methodologies that
attackers use is social engineering? So what they
will want to do, is that
Create a malicious payload in
which the moment the user tries to click on
it. It will open up on its own browser. And
as we saw in this particular case, it was able to fetch the
dog cookie. Also and taking that cookie,
they will be downloading it
on their own web server. So how can that be done?
Whatever purposes have already, copy-pasted the payload. So
as you can see.
An attacker can use any real-time attack such as Pine
URLs. So these are URLs that are short in
nature, but actually when they would be
addressed by the browser, will actually expand
to and proper full fledge URL. So
if we send any of these short
URLs to any of the victim, they will not even know
what is behind this and most of the time it is
quite right to assume from the attackers point of view that
they will click on it and they can
Actually, take the cookie. It's
what I've done is that I've added additional commands for
that. So what I have done is that, in my own
local system.
For demo purposes. I have quit when an attacker page, which
is running on PHP.
Under that. What I've done is that I've created a get parameter, which
is actually priced the document value.
And on the back end also created a notepad which
will actually save every session ID. So
if I am able to send to multiple people and
they run the same website and the click on it, all
those cookies would be stored on my notepad.
But an actual scenario, it is pretty much
sure. That this document out location would
be redirected to a different website,
that's owned by The Tackle themselves where
they will be actually storing all those sessions in real
time.
And apart from that, there's one of the pillows that I put the
moment. This particular trip side, redirects to
this location with attacker page. Also created an
additional redirect. For example, in this scenario. It
will go back to facebook.com
So, let's see what happens if a
person clicks on the link.
So this is the particular note pad that I have created in
which we actually store all of the Scoobies in
real time. As you can see. It is already stored.
This particular pH P value.
So in this way, an attack can actually store
all the cookies in real time and uses on the
website just by copying this value and
actually going to the developer tool and replacing, the cookie
value in that way. You'll be able to hijack the session. Now
just to be sure, let's reiterate the scenario again.
We have a user who's actually trying
to access a website.
And we also have an attacker in which you. So
initially the tiger is trying to send
a payload using social engineering methodology.
Maybe via Twitter or any other messenger case.
So, once the user clicks on the
link, the request will redirect the web server.
And the payload is executed and the response is sent
back and you to that what is going to happen. The
attached payload is going to send back the cookie
the hijack fashion to that account.
That's it for this video. Thank you.