Hello everybody and welcome back.
And let us continue with our cross-eyed scripting attack.
So in the previous video we discover that this page right here is vulnerable to the reflected cross-eyed
scripting as we checked with the alert.
Hello.
Uh.
Function.
And it opened up a window where it says hello and it can also be used to send over a link to any victim.
And that is the reflected cries.
Uh cross site scripting attack.
Now these cross scripting can be done both over get and over post methods.
This one right here was an example get method as we can see in the link we're sending it.
So it means it is over get method we can I can show you once again so we can just type Here open this
and then intercepted in burps it and then submit it and you will see that it is get method I just can't
see that packet which is a little bit weird.
Did I click on it.
Submit
weird it doesn't want to work it doesn't matter at this time.
So just trust me on my word it is the you get method.
So let us continue with D next attack.
So let us open up our little machine once again.
Let me just open up freshly page first open page and right now where you want to go if you want to find
the wacko Pico Page let me just find this right here.
There it is.
So just click on it.
It will lead you to a page that we did in Korea that we didn't visit previously.
So it is new for us where we want to go right here is we want to go to the guest book right here
it is is taking a little bit to load up and as you can see right here it loaded the shallow window screen
for me now for you it will not load that since I already tested some of the comments on this Web site
and on this a certain page guestbook page and every time now that I visit this uh it will prompt me
with the yellow screen what that means.
Basically it means that this is the example of us toward cross-eyed scripting attack.
Why is it stored.
Well basically anyone who anywhere please visits this page will get that window shown and in the previous
attack you would have to send that over a link in order for that window to show since that is reflected
across scripting attack.
This is a more dangerous version of the cross-eyed scripting and it will save the the part of the code
on the Web site and it will show it to anyone who visits this page.
So basically what I did here is access this test
and I type here script and then the same script that we used in the previous video so shallow or we
can just type here something else let's say capital hill and see if it runs that as well.
And then we closed this script and if we submit it you can see that it prints out with big letters.
Hello.
Now you do not have to send any link to the victim.
Basically what the victim has to do is just open up the page by themselves without any official link
or anything like that and they will also get prompted with both of those screens.
So that us just check out and let us pretend that we're victim from different parties and different
B.S. and we click right here on guestbook and we could see we get the hero right here and that's why
this is dangerous or more dangerous than the previous attack.
We also see that prints out the previous yellow which I also did before I started recording this video
but surely we can do something better than just prompting these shallow window to the anyone visiting
this website.
So
what we can do for example is we can steal cookies from anyone who comes to this page and we can perform
the session hijacking with those cookies.
Now it is a different type of script.
So what you would want to do right here is basically type here so we can name this anything we want.
It doesn't really matter.
And what we want to do is script then what we want to close this and document not right now what I'm
writing right here is basically just a simple javascript code in the same thing that they set for the
ask well if you want to learn more about it you should search it online and look some of the tutorials
about JavaScript code.
This is just a simple one line code or two line code that we type right here in order together.
Cookies uh there are a bunch of other options that you can do with cross-eyed scripting what we will
not cover it in great details will only cover some of them.
So this is one of them.
And let us just type it right here.
Image source equals.
Now what is more to my typing right here is basically.
Now I want to specify the website to where the cookies will be sent.
Once a certain victim is the page so what you want to type right here is any website that you.
If for example own or something like that.
And there you will receive the cookies of the victims.
Now we can simply just use a python server.
Let me just close this but it sometimes doesn't work.
Not really sure why but we can try it right now so what you want to type right here is a final exam.
If I remember correctly it is Python minus M for the module and then entity P server.
Which means that we will start the simple python HDP server and then we need to specify the port on
which we want to start the server.
So let us just do port 7 7 7 7.
And for some reason this doesn't work.
Let me just try a different port 8 8 8 8.
No it does not work.
Well maybe if we tried the Python 3 instead of the Python 2.
So just add here.
Python 3 and you can see right now it works.
So we are serving in GDP on local coast or on any interface port 888 and we are listening for inbound
connections so that is good.
Now what you want to do is finish your script in the on the website.
Now that we have website and now that we have a website to listen on we want to type here.
Double quotes HDP 127 dot 0 0 0 0 1.
Since there is where we will listen for the connections and after that we want to type here to dots
and specify the port which I believe is 8 888.
Let me just check that out.
Yeah it is 88 88 so once we do that what we want to do next is uh to just go into the next line with
this command.
So just type your slash right.
Uh apostrophe plus then document dot cookie.
So we are gathering the cookie and then plus and then apostrophe and then double quote We want to uh
at the closing sign of this arrow and then we want to add another quote and close the parentheses and
then type here.
The script has the script is ending right here so once we do that we have our full script written right
here and all we have to do is basically just click here on submit.
Now why is this the lines from how to make to the tab.
Okay.
We do not need this page anymore.
So let us submit the script that we have just written in order to keep together our cookies.
And since we are loading the page again we get these two boxes.
They prompted with Hello.
You should get them to if you already type the alert function as we did before.
Now let me just check something right here.
We didn't receive anything yet.
So if you for example pretend that we are a victim and we visit that website to a link or through our
own Web browser and we go to the here and we go guestbook.
Let me see if we got any cookies saved.
OK.
So we loaded the page and it doesn't seem that it works right now.
As I said sometimes it works and sometimes it doesn't.
Not really sure why.
So let me just try to switch it up a little bit.
So we added Miguel at another same looking script.
So just type the same thing you typed before.
So document write an open image source.
Source equals double quotes and then we want to type here 0 0 0 0 and then the port which is 888 and
then what we want to do is to add a cookie from that port so loss document cookie plus uh apostrophe.
Double quotes and then closed brackets or closed this arrow.
I'm not really sure if I even need that arrow since I didn't let's just try it like this.
I possibly could be carrying some syntax error since I'm not that good at javascript I didn't really
learn it.
I only used it in process scripts in the text so let's just try to run this once again click here okay
on these already alerted pages.
And let's see if we get anything.
The display is by my.
That will repeat any action we send shallow shallow
okay.
Hello.
The pitch is.
And here we go if we go right here we still didn't receive anything which it doesn't really matter it
could be the problem in my syntax or it could be the problem.
He does this a CTP server.
Uh it doesn't matter at the moment.
So if you want to find some of these specific attacks you can just search on the Internet for the cross-eyed
scripting javascript code for example you can take a screenshot of most people's browsers and all of
the cool stuff but we will not cover all of that.
You can find it all on the Internet for now.
I just wanted to show you this.
And in the next lecture I will show you a different type of the attack which basically just uh changes
the look of the website itself.
So we will do that in the next lecture and that's about it.
For now I will see you next lecture and take care.
My.