‫Input and output manipulation is the most important part of hacking websites and Web apps.
‫The two most well-known vulnerabilities, excesses and sequel injection are the subjects of this section.
‫If the inputs and or outputs of a website are not adequately validated, they might be the subjects
‫of exploitations.
‫But before we start talking about input and output manipulation, we should understand a few terms and
‫policies first.
‫One of them is same origin policy.
‫A web browser permits scripts contained in a first web page to access data in a second webpage, but
‫only if both web pages have the same origin.
‫This policy prevents a malicious script on one page from obtaining access to sensitive data on another
‫web page through that web pages document object model.
‫Thanks to this rule website, A cannot access the session idea of web site B.
‫An origin is the combination of protocol used for the communication, entire hostname and port.
‫Let's have a look at a few pages and see if they can access use Mientkiewicz file.
‫This page can access the Use Me Dargis script because of the protocol, host and port are the same.
‫Remember, if we don't specify the port, the default port is used and the default port for FTP protocol
‫is 80.
‫This page cannot access the script resources.
‫The hostnames are different.
‫Be careful.
‫www.YouTube.com is not the same as ABC.com.
‫These are two different domains.
‫In most cases, you go straight to the WW W page, even though you don't put it into the URL.
‫For example, if you write Google.com in the address bar of a browser, you reach the WW W Dot Google.com
‫page.
‫Now, that doesn't mean that these two addresses are the same.
‫That means Google servers redirect you to WW Dot Google.com address.
‫When you try to reach Google.com.
‫And look at that, the ports are different.
‫JavaScript is a high level interpreted programming language alongside HTML and CSS, JavaScript is one
‫of the three core technologies of worldwide web content production.
‫It is used to make Web pages interactive and provide online programs.
‫It's the JavaScript codes that run the browsers.
‫The majority of Web sites employ it, and all modern web browsers support it without the need for plug
‫ins.
‫JavaScript can be used in an HTML file in three different ways.
‫You can write JavaScript codes into a different source file and call it from the HTML page.
‫You can write script codes into the HTML file using script tags.
‫You can write script codes in event handlers, so everything exchanged between the browser and the server
‫are inputs or outputs of the web application, text or edited boxes on the web page.
‫Headers of the request sent to the app Hidden Fields or even the header that does not exist in the original
‫request might be an input field for the application to minimize the risk of threats.
‫One of the most important principles is validation of input and output fields.
‫When the input source is not reliable 100 percent, the input is not reliable and shouldn't be used
‫inside the system before validating client side.
‫Input validation is done by script, JavaScript, VB, script, etc. The main purpose of client side
‫controls is the performance.
‫Users are warned about their mistakes before sending their request to the server from the security perspective,
‫client side controls can easily be bypassed.
‫Remember, we are able to intercept the traffic between the browser and the server using personal proxies,
‫for example, Burp Suite.
‫So let's see another way to bypass client side controls.
‫We leave a message to a friend's guestbook.
‫But the maxlength of the message field is 50.
‫We want to leave a longer message.
‫Right click investigate element and increase maxlength value.
‫Now we're able to leave a longer message.
‫So for this reason, client side controls are good for performance.
‫In addition, server side controls have got to be done for security reasons.
‫While validating input parameters, we can talk about two different approaches in the first approach.
‫We have a black list and the second approach.
‫We have a white list.
‫The first approach does not allow the inputs which exist in the list.
‫The second approach only allows the inputs which exist in the list.
‫The first approach is called negative data validation, and the second approach is called positive data
‫validation.
‫The first approach?
‫Negative data validation is dangerous, and it's not advised to use.
‫First, the number of malicious inputs are theoretically indefinite.
‫Developers should think of every possible form of the characters capitalized and coded or escaped seriously
‫anything you could think of.
‫Secondly, developers should be careful about the algorithm of this sanitization method.
‫Output validation is as important as input validation.
‫Outputs which are sent to the client should be sanitised just before they're sent by the server.
‫Even if we validate inputs, we should validate outputs as well.
‫The output prepared to be sent to the client on the server side may have turned into a harmful value
‫encoding.
‫Also known as character escaping, is an effective approach for both input and output validation.
‫If you encode the special characters, they are not going to be interpreted and just printed out.
‫For example, we have a blog and we would like to publish a post that includes these lines.
‫While testing for excess.
‫First, try this.
‫We prepared this page.
‫Show the page without H.M. encoding when we call the page, we get the message on the screen because
‫script tags are interpreted by the browser and this script runs if we encode the smaller than character,
‫it's no more a tag starter.
‫It's just a character to print out now.
‫Escape smaller than character.
‫Save the file, call it from Firefox.
‫Show the result.