-: Welcome back.
I want to quickly talk about another vulnerability
or a bug which is called HTML injection.
And it is quite similar
to the cross site scripting attack.
Just as its name says in this type of the attack,
we're not injecting JavaScript code
but instead we're injecting HTML code.
And you might say that that is not really dangerous.
However, even though that is correct
HTML injection is still a bug
that you should be searching for.
Why?
Well, if there is an HTML injection
in some big company, what an attacker could do
is they could change the entire page look.
They could add whatever they want to that page.
They could pose different pictures.
They could completely change that webpage
to their own liking just by injecting HTML code.
And that would be pretty bad for that company
because someone else would have a complete control
of how that page would look like.
So how can we test for that?
How can we find HTML injection?
Well, you can just go and navigate to the access reflected
and XSS stored that we covered in previous videos
and we can test for HTML injections here.
So usually what you want to test is different HTML tags,
such as h1, h2, or different header tags, just to see
whether your input will be interpreted as HTML code.
So let's give it a try.
Everything is low and if I go right here
and just type h1, which is an HTML tag
for header size one,
and I type test close the HTML tag
by typing these arrows and then closed h1,
I click on submit and we can see
it does indeed interpret our input as an HTML code.
If we were to type for example h2
or h3 and then test once again.
This would be smaller size, which is a good enough
indication that there is an HTML injection on this page.
Now, there is no point of us changing this to medium or high
because this specific input is used for JavaScript attacks
so only JavaScript syntax will be filtered.
Therefore, HTML injection will be the same
on medium level security as well.
As I mentioned, this is also a bug and it should be reported
because for now we only typed in a small HTML code
which changes our input to size one header
and size three header.
But what we could also do, for example, on a stored page
and let me just reset the database real quick
from the previous video where we covered the XSS stored
and if you were to type an HTML injection right here
let's say the name will be test, and here we type
this code.
Let me first write it inside of a terminal
and then we are going to copy it
to this page,
just so you can see everything better.
So open brackets
and then meta,
http,
equiv, equals,
open double quotes,
refresh close double quotes
content
equals
zero,
dot and comma.
And then space URL equals http,
slash slash,
google.com.
And then close double quotes
and close the tag by typing slash and close right arrow.
If we were to inject this code,
well let's just see what would happen.
Let's copy with this code right here.
Go to our page and type it here.
I click on sign guess book.
And do you see what is happening?
It is constantly trying to go
to a different page
and it is constantly refreshing that page.
It pretty much made the page completely unusable
because we cannot even go up here and type something in.
So what we must do is we must change to a
different directory such as file inclusion
and go and clear our database or reset the database
because we will not be able to visit the stored
since it'll automatically start refreshing the
page and trying to visit google.com.
However, if we were to type same right here
in the reflected
and we were to change, for example
from google.com to facebook.com and click on submit
well pretty much the same thing would happen
but for some reason it doesn't want to visit
facebook.com and we are going to take a look at why that is.
Let us see whether we specified something incorrectly.
So URL equals http.
Okay, so I've tested it out and for some reason
it doesn't seem to work on Kali Linux browser.
But if I go to my Windows 10 machine and I visit the
metasploitable page,
and right here I copy the same code
that we just sent in our Kali Linux,
just we copy it and try it from our Windows 10 machine.
I just changed the URL to be Bing.com,
paste it right here and click on submit.
Well, now it fully redirects our access reflected input
and the entire page to this Bing.com website.
Let's give it a try.
What happens if we do that on the stored?
So I type test as name, and I type this command right here
as a message and it appears that there is a limitation
of characters right here.
So what we can do is we can inspect the element navigate
to the body, then let's go and find the message input.
So under the form we go table, body
and message input.
We check right here it says that the max length is 50.
So what I can do is I can type 500
and now if I go
and try to copy this, so I will just delete all of this
paste the code and click sign guess book.
Well now it actually redirects.
So you will see that even
when I try to go back and I go for example to Brute Force
and again on XXS stored, it'll just load Bing.com.
So with the help of code injection
we can even redirect pages to different websites.
And this is usually what attackers do.
So if they find a stored code injection vulnerability,
what they will do is they will just
inject a redirection link to a different website
possibly a malicious website or a website where
they advertise something or something similar.
And every time someone visits a page, for example
they want to go
and XSS stored on our metasploitable page.
Well, they just load bing.com
and that is the power of HTML injection vulnerability.
So now that we covered this, in the next video
we're going to go onto another big vulnerability
which is called SQL injection.
See you there.