So let's talk about how to discover these kind of vulnerabilities very similar to Eskil injections.
The way to do this is you browse through your target and try to inject any text box or any your l that
looks similar to this.
So whenever you see your l with parameters try to inject these parameters or try to inject into text
boxes
so let's have a look on reflected as access as example.
So these are the non President non start vulnerabilities where you have to actually send the code to
the target and wants to target runs the code.
It will be executed on their machine
so let's have a look on our DV w a website and I'm just going to log in
and then we're going to have an example of a reflected accesses so as you see now you can put your name
here for this text box and it's just going to say hello.
Now this is obviously just an example.
But the idea is you can inject into text boxes.
Also if you have a have a look at the URL here you'll see that it's a get so you can inject into the
URL as well.
So let me start the d pad
and let's try to inject access code on this and see if the code will be executed or a javascript code
sorry.
So what I'm going to use is a very simple script.
So we're using this script and as script tag.
Now there is a lot of ways into discovering these kind of vulnerabilities and a lot of ways to bypass
filters.
But for now we're just having a look at the basic case where we can inject a normal script and I'm going
to say alert which is just a function to give an alert to give a text box and I'm going to say
X as s so I'm going to click on submit and we'll see if this code will be executed
and as you can see now it's actually executed in my code.
So instead of saying hello Z here it said hello and my code has been executed and it produced this exercise
so we can do the same here if you have a look at the URL it actually already did it for us but if we
look at the URL here it's just going to be a bit bigger there.
We can see that the name has been obviously all of these characters are just hasty and well escape characters.
And now if you send this your URL to anybody whoever views that you are l what the code will be executed
on their machine and it's going to say exercise so let me show you here.
You can also inject this into your eye.
I just want to show you the whole idea of that.
So we have script slash script access
and if I hit enter the code will be executed.
So as I said we can copy this and send it to a certain person.
And once they run that code this code will be executed on their machine.