So B, Web handles different aspects of excess very well, and the next example is one of them.
So after logging into B Web, choose reflected Jason from the menu.
And there's a search box on the page.
So let's examine the page a little bit.
So I'm going to type t h o r into the box.
And yet we have that movie.
It's a positive result.
Now, what I type is also in the you are l the title parameter holds this value.
OK, so now let's view the source.
And here, as a result, the page sends Jason data.
And this data is parsed and printed to the page.
All right, you ready for another enter i r o n MRN without spaces.
And a negative result comes back, but also the data is reflected.
And the value is still in the early.
So view the page source again.
And this is my input and it is reflected to the page.
So like I did in the previous lesson, paste the HTML, H1 tag.
OK, it works.
And paste the NBA link.
OK, so something went wrong here as view this horse.
Link is here.
OK, I think I found it, did you?
So the single quote caused the problem with Jason.
So if I add back slashes before the quotes, it will work.
So this problem is solved now before we go any further, I do want to show you the code.
So open terminal and just have a look with me.
Now, here, if the level is low, the title parameter is used as is.
It was not low, it is checked with a function.
Then the output is generated.
And scroll down.
So now here is a script.
And the output is added into the script.
And then, as you see, if the result is negative, the search term is sent back to the browser.
So go back to Firefox's.
And we can run HTML tags entered into this field.
So let's paste this tiny script.
OK, no, it doesn't work.
So now to figure out what's happening, let's view the source.
Because my input breaks the original script, right?
Now, this part is between script tags, so it can't be executed if there's, you know, anything meaningful.
And the rest is not between script tags.
So the browser uses the remaining part as text, so displays text in the page.
So now type ironmen to clear here and do the source.
Now we can create our payload, which doesn't break the original script.
So I'm going to just write it here.
And step by step, I will create the payload.
So first, let's close these double quotes around our input.
Then using this curly bracket and then this bracket and then the single quote around the Jason data.
And a semicolon to and this line.
And close the opening script tag.
So now we can start our payload.
First alert, the cookie is always then add an opening script tag.
And that's it, so let's copy this payload.
And based in the search box.
And yeah, the JavaScript code executes.
And that's a view, the source to figure it out better.
And this is the first part.
So doesn't have any meaning to the page.
And then this is our actual payload.
And then this part is the remaining code.
It also doesn't really have any meaning to the page.
OK, so let's go back to the page.
Now we can send the session value to our kookie steel wrap.
And we have the payload.
So I'm going to copy in and out of here instead of the alert code.
Then copy this line.
Open a web developer tool.
Base the code into the search box and go.
The requests sent from this page are below.
And base64 cogie value is sent to our stihler application.
So if you the source.
So our good payload is lying in the source.
So open this dealer at.
Refresh the page.
And the cookie values come up.
So now let's go to our session.
This is our user.
And we are able to send the user session.
OK, so go back to Kalli.
Now we can use this URL to get any user session.
So we get to see the user to click on a link comprised of this URL.
Then get the session.
And we've already done that in a previous lesson.
So I'm going to leave that for you to do.
All right.