Hello everybody and welcome back.
Name the previous tutorials.
We showed some of the Emanuel attacks on the moral pages with the cross-eyed scripting attacks.
So we showed you reflected the store and the based on Dom injection attack.
Right now what I want to show you is which tool you can use in order to automate this process.
So one of them which is already installed in the clinic's machine or the repository I believe it is
called X as as you are.
Let me just type here.
Here it is.
The name gives us some banner and it also gives us some of the options.
Now as you said it can be installed in clinics so you can just type this and you will see the same output.
This tool right here it is.
It is made to detect the access vulnerabilities and exploit them it can detect the stored access reflected
exercise and access says based on Dom.
We covered all of these three in the previous videos manually and now you can do them automatically
with these two.
So let us just find a page that we will scan.
Let me just check once again intercept off.
So we go to the Firefox let us visit our vulnerable or was little machine once again 168.
That one that's six.
And here let me just find out what was on that page once again.
I believe it was this one budget.
So let us just try it.
Why not so just click on the budget and right here what we want to do is a
just go on to this search.
Yeah it's right here.
I believe this is the one.
So you have here this page which is one and to the ones here demanded six or whatever your IP addresses
slash budgets slash search dot GSP.
Now we can see that if we take anything here.
So it just like anything.
It will search for anything and it will store our anything.
And we indeed some value very variable called Kill.
So this sent over the get request as we can see right here now what we want to do.
Let us say we want to automate the tool the access you are tool to find out some of the more abilities
in this page.
So let us just copy this link just in case since we will probably need it.
Now let us just enlarge this and type help so access is E R minus minus help and we get here a bunch
of options.
So let me just check go up towards what we want to do.
We want to specify the minus you option which is the URL.
So here it is.
This is a must.
So we need to enter the target link in order to run this minus.
Gia I believe sent payload using get yes we we are sending the payload using the get method which is
the method on that page.
Website and we also want to specify I believe the Q option because we store our valuable in the queue.
So let me just type right here.
Let me just try it out.
Not really sure.
There is an option like that in the tool but let us try it.
Why not.
We delete the anything.
And right now we want to delete this as well.
So this is the page that we are searching for.
Minus G for the get method and we want to add the parameter that we want to scan.
So let me just find my question Mark.
Not really sure where it is.
There it is.
And then queue equals.
So it is scanning using method get and it is scanning parameter Q.
So let us try to run this.
It would basically at the parameter after uh it would basically add any any scripts that it will run
on the server in the parameter queue.
I believe that's how they.
I believe that's how this should be specified let us try.
So let me just run it and it says the server has not found anything matching the requested you already
mosquitoes then need finder results in Jackson's one trying browser injection results server has not
found anything matching the request.
Now why is that.
I have no idea browser support hashing cannot find any vulnerability.
Try another combination or hack it manually.
Well we were not hacking manually since we did it already but let us try some of the other options.
I haven't really used this tool.
That's why I don't know how to actually correctly put this so verbose.
We do not need that.
Select targets at least one of these options must be specified said the source.
Okay so we did specify we said that you are out to the target select type of the HDP or HDP s connections.
We said the get method.
Okay so set access as a keyword in the places that you want to inject okay.
So set access SS as keyword that could be possibly what we were missing.
These options can be used to specify which parameters we want to use this payload set X access.
So let us just set exercise right here and try once again.
But as it said right here it says again the server has not found and that's not what we were hoping
for.
Cookie change or cookie Heather these are a bunch of irrelevant options at the moment through the sure
but it doesn't want to work.
Maybe if we specify it like this maybe we shouldn't really
divide these two.
Maybe we should just type it right like this that is targets minus G is not the correct you are all
discarded.
So and what about this.
Okay so we just need the experiments and sometimes they do not give the example of usage of this command.
You just tried
maybe we need to specify it like this.
So this is the website that we are searching for minus G now and we want to specify the path.
So here what we want to delete is delete anything.
So type here except access and then delete the previous part and let us try it like this checking your
attack with payload.
It doesn't give us that the server can be found but it says that it couldn't find any one abilities
which is not what we were hoping for anyway.
Not really sure why this doesn't work.
Checking Euro tech with payload fail why does it fail.
I have no idea.
Let me just check one more thing.
I can't seem to figure out why this doesn't work.
Let me just try this once again.
And it says fall for not found.
No.
Why is it not found.
I have no idea.
Could be a problem with my connection at the moment but it says right here that it is OK.
Then what is it not found.
The server has not found anything mentioned the request
Oh wait wait wait wait.
Tweet tweet tweet.
Why does it add this slash right here.
I do not want to add edit.
Why did tell it.
No idea.
Let me just check the link.
Maybe we copied something wrong.
No this is the link and maybe it will work later on.
Not really sure.
But if it if we just do this and then paste once again and then we delete everything but this and this
know sometimes you might need to experiment with a few options like this before you get it to work.
He had a low check for the target discarded mosquitoes landed.
Well it doesn't seem to work either.
Let's try this.
He's our target.
Even online.
It should be
well it doesn't really matter.
Let us go on to the next tool.
Not really sure why this one doesn't work.
I believe the syntax is correct.
Let's just go on to the next tool which is the excessive sniper.
This one might work a little bit better or it might actually work for different.
So this tool does not come pre installed in these clinics so we will have to install it from GitHub
so just open up your Firefox add a new tab and go to access sniper minus sniper and click on it to search
it and you should also see a github link from where we will download it now.
I didn't download it yet.
At least I don't remember down the lead.
So let us download.
Let us download it together if our internet worked.
Here it is.
And here you just go on the first link which is GitHub and the access neighbor as it says right here
it is an automatic access discovery tool so we will try to see if that one works.
I'm not really sure why the previous one didn't so just copy the link and let's install it in our root
directory so you get clone as we already know.
And then we paste the link and then dot get it for clone the 4 and the directory unto our root directory.
So let us go to the exercise sniper and see our files right here.
We can see that this is the python file so let us just run it right away since it is green which means
it is executable and let us run access sniper.
It gives us the our available options.
So what we can do.
Options h help you or else so we will use that you url.
We can use forms use arrangement crawl poor so random agent cookie.
These are just bunch of the options used for the anon ization to anonymize yourself as we can see is
can behind the forethought.
And so on and so on we just want to.
For now on use the you are all option so just type here typed on accesses sniper minus you for the URL
and then lets paste whoops Yeah I copied the wrong you URL.
Let this just go once again to the page itself and copy this year out
okay so we will just delete it from here.
Close this and then paste that you are not really sure now which your URL to we need.
But let us just try it like this and we can see that it found result found access injection points in
1 targets we can see that this tool has found the exercise injection finally something works so we can
see target which is our target method get query string.
Is this now what means by query string.
This is just punch routine coded encoded characters and we can see injections one payload found free
in each the amount so we can see that we successfully discovered the excess probability with this tool
with the previous one we couldn't.
Not really sure why but it doesn't matter.
It matters that one of them worked probably the other one would work as well sometime.
Maybe we specified something wrong.
It doesn't really matter at the moment.
What matters is that we successfully finish the web penetration testing section which was one of the
first longer sections that we will do and we might cover some of the other attacks.
Some of the more advanced attacks in the advanced section also used on Web sites but until then we will
need to cover some of the other sections which will be divided the second section the mall where the
methods point framework and punch of other sections so we can finish the up and trace testing right
here and we will continue hacking in the next lectures.
Now I hope I see you there and happy hacking my.