Hello, everyone, welcome to this video.
So I assume till now you have learned about XHTML and you know how the basics of HTML work, so it's
time to jump into HDMI injection attacks and understand how you can find a general election in any target
website.
Before that, let's understand what exactly is a Tmall election.
So it is a type of vulnerability which occurs in Web application that allows users to insert HDMI cord
via specific parameters, which we also call this entry points or injection points.
Always remember, XHTML election can only be exploited with the help of social engineering attacks.
That basically means we are going to trick valid users of the application to fall for our XHTML injected
web page so that they give their credentials into our fake login forms or a malicious website so that
we capture their cookies and credentials.
All right.
So now we understand how an HDMI connection attack works and how are we going to benefit from this type
of attacks.
Remember, again, this attack only works with the help of social engineering in which you have to make
the victim come and click on your specific links and you assume that he's going to fall for your attack.
So let's see a normal search template over here.
So this is a very, very simple code from a Target website.
Within a year, you can see e-mail starts at e-mail.
Close your other results that match your query for anything that you search on to any target website.
So let's say you search for a product that is computer on Amazon.
This is how the output is going to look like, which will give you some results.
Let the result end result be.
Now the attacker is going to put a query into that search box and you can see this is the query, which
looks like it's to tag special offer and there is a giraffe in the background, which basically means
that it is going to redirect on the attacker dart site, which is a malicious link.
So when the attacker is going to put this link into the search pattern and it interprets this and gets
executed, and if the victim clicks onto that special offer, he will get redirected to the attacker
control domain.
Now, when the attacker will actually input his query, then how this will look like you can see the
code over here, the attacker input query, which redirects to the malicious site, as you can see here,
your other search results that match your query.
There's a special offer and the atrophies to the attackers, a website.
And when the poor victim will click onto this special offer, he may get redirected to the clone of
Amazon.
Let's see if it is vulnerable and will end up logging in or doing some sensitive actions which can compromise
his integrity or confidentiality.
So it is the practical time and let's see how you can demonstrate this type of attack.