Hey, guys, welcome back to another episode on How to Hack.
So we're here at Mutal today, which is a vulnerable Web application platform for us to learn about
ethical hacking, penetration testing on common web vulnerabilities.
And this is all supported on the left side, as you can see, open web application security project.
Twenty, seventeen.
And today we're going to look at cross site scripting.
So right here, OK, we have this page, which is the password generator page.
So you can access this from about twenty seventeen, go under one injection order and then you can go
ahead and click under JavaScript injection and click under password generator.
OK, go ahead and click on it.
So once you're in you can see the following.
Right.
Making strong passwords is in point.
Click the button below to generate a password.
This password is for anonymous.
So once you click Gennari password, you can see that it will automatically generate some recommended
passwords in a straw, has 10 characters in a birth mixture of Apple with cases and symbols.
So the next thing for us to do is in terms of examining this webpage, where is the injection point?
Where exactly can we go after and input our payload into the system?
So that's the key question to ask when you're examining a webpage.
So what we can do now is I can go ahead and use magnifier so that it's easier for you to see.
So the number one injection point that we can go after is actually on the URL.
So as you can see here, we have the following.
You have indexed PXP, questionmark page, equal password dash generated and username equal.
OK, and this is a really important part because all I'm going to do is just change the username equal.
Let's say I change it to Loy Yang Yung.
I hit enter on this and we can update this password is for Lioy down so immediately we can see the changes
and this is going to be the input you for us to be able to inject into the website, injecting our own
script into the website which is called Cross Site Scripting, injecting our own script into the site.
So what I can do next is go to the top right corner and you can go ahead and click on the preferences
and in preferences, scroll all the way down to the right, click under network settings and select
menu proxy configuration.
All right.
So we have the proxy.
All right.
This is one two seven zero zero one and on port eighty eighty.
So click OK on this.
And what I can do is to go ahead and open up a terminal and all I got to do is enter upsweep hit enter
on this.
And this was started purposely to intercept all those information that we sent from the browser into
the web application system.
So I can click close, I can click NACS and I can use Fort's click Sukhbir.
So once we're in, go under the proxy tab and make sure that you have to intercept is on.
All right, so once intercept is on, go back to Firefox, OK, I can do a refresh.
All right.
And right here we have intercept it so I can do it right.
Click send to repeater.
Right.
Go in and click on the repeater so you can see the repeater tap in orange now.
Right.
And right here we can see we have to get.
All right.
And then we had a beautiful day.
Pass the generator.
Right.
And username equal so you can just click send and I can do a quick search.
And this is the part that is displaying.
All right.
Using dot html.
So there is a document, don't get Elliman.
So this is an element inside the e-mail page, which is called ID username input.
All right.
And don't in HTML, this password is for Loy Yang Yang.
So they are actually updating the information through this JavaScript, as you can see here.
And we have to script, OK, and we have try, we have document, get Elliman by ID and we have catch
alert it as an arrow.
You would actually display the error message using it on message.
OK, so it's very important for us to actually understand JavaScript HTML and how is being used to actually
represent information.
All right.
How is being used to give the user a different kind of customer experience?
So what we can do next is to go ahead and copy this whole chunk of script.
All right, do it right click and you can just click on a copy.
You can just do a control C go ahead and open them up, for example, mousepad.
All right.
Or you can use any of the IDs to actually paste the code over.
OK, and I'm going to explain to you precisely what it all means.
How are we able to generate a payload that allow us to actually hijack into the JavaScript?
OK, so over here, this is the value.
The one highlighted in purple is the value that we are trying to replace.
So we're trying to replace it with our own screen.
So, of course, what we can do next is that we can go ahead.
OK, I already have the payload on the top here, as you can see.
But I want to explain to you precisely what we are trying to do.
All right.
So we have this password is for the following user.
OK, and what we're trying to do now is I'm just going to highlight to you how it looks like when we
try to inject it.
OK, so what we are trying to do here is to close this off.
All right.
So we are closing this off.
All right.
And again, this is a semicolon that is used in JavaScript to actually help us close off the initial
statement.
All right.
And of course, the next thing you can look at is in terms of over here, so you have a clearly open
bracket.
Try OK.
And then we can close it with a closing curly bracket over here so we can close it over here.
So this will close a try statement.
And what we can do next is to replicate what is shown over here, which is a catch.
So we're trying to catch some error messages so I can enter catch.
OK, so we are repeating here and then I can have a open bracket followed by closing curly bracket.
OK, so again, we are not going to have any kind of display of data on display of information where
we catch an error messages.
That's not the purpose of the what we're trying to do here in the payload.
What we're trying to do here is to have our own script and we want to test whether this site is susceptible
to cross site scripting.
So we will use over OK and with the alert.
All right.
This would then be sent.
All right.
Immediately or being executed immediately.
Hacked it by Lioy.
All right.
And what I can do now is to have a semicolon, OK?
And this closes off the first part f everything that you're seeing here.
OK, so this closes off the first part of everything you're seeing here.
So what we're trying to do next is to be able to close off the rest of the instruction.
OK, we're trying to close off the rest of the instructions, so we have to try.
All right.
Then we have an open curly bracket and then you can put whatever variable name you want.
OK, so all we got to do is over here, OK, equal and then followed by a double.
So this double code will close off this part.
All right.
So this curly bracket and is double code because of this part.
OK, close all this part and then you have a closing curly bracket.
They will close off to try and then you have a catch.
So this closes the rest of the other part of the script, the ending part of the earlier script that
you saw.
So with that, this is all payload.
Sol Palit will start from this part, OK, which is the double code all the way to the following.
OK, so this will be OK.
And we'll inject this into the website to check whether this site is susceptible to cross site scripting
attacks.
So what I can do now is to go back OK and copy the payload here.
OK, go ahead.
Copied over here is the same payload.
So I go back to say, Firefox, which is your browser and I can actually go under.
Preferences.
OK.
And I can close off the proxy, no more proxy and go back to the browser and all I got to do is paste
Paillard over here.
OK, so let me just delete off the first name.
All right.
So we have the following payload into Eurail, Lioy Lengyel, WQ semicolon, closing curly bracket.
All right, catch followed by E all right.
And closing off of the catch statement or alert.
All right.
So we're trying to test whether the site is susceptible to cross site scripting attack and closing off
the rest of the JavaScript statement.
All right.
So let's hit enter and see what happens right here.
We've got a pop up.
OK, so again, what can we do when a website is susceptible to JavaScript attacks?
It means that we're able to see, for example, copy this whole thing, send it to a user, and once
the user clicks onto the link, we can redirect a user, we can redirect a user to a different site,
OK?
We can make certain instructions, for example, taking the kookie data of the user and sending it over
into one hour service that we have running to capture all those data and information.
So a lot of things that you can do once you discover a cross site scripting vulnerability on a website
and you can exploit it for a lot of different kind of payloads.
Right.
So once again, I hope you've learned something valuable in today's tutorial.
And if I have any questions before you leave a comment below and I'll try my best to answer any of your
questions and we'll like share subscribe to the channel so that you can be kept abreast of the latest
cybersecurity tutorial.
Thank you so much once again for watching.