OK.
Now let's have a look on a excesses.
Example now started excesses is very similar to a reflected one.
It's it allows you to inject javascript code into the browser.
The code is executed on the people that visit the page.
The only difference is with this with the reflected.
You have to send the URL to your target.
So the target had to actually click on a new URL for the exploit to run or for the code to run and the
store accesses the code will actually be stored into a database or into the page.
So every time any person runs that page they will see your code and your code will be executed.
So you want me to interact with any users or send them anything therefore this could be much more dangerous
than reflected accesses so let's have a look on this.
Now I clicked on the excesses third here on the left and you have this page and this page just allows
you to add a message to the system.
So I'm going to put my name as a we're just gonna do a normal test first and we're gonna put a message
by the year for example and then I'm going to sign the guest book and you can see that Zaid I a message
called message body.
So if we go to hear to another machine.
So this is a different machine to a different place.
And if we go into X asset store we can see that there's two entries so the entries are being loaded
from the database and that they contain the entries in that database.
So if we manage to inject code in here then any person who runs this page the code will run it without
even having to send that person anything.
So let's try to inject stuff here so let's put my name as a and I'm going to try to put my code in here.
So I'm going to try to inject into the message I'm going to call it a script.
I'm going to use the exact same code test code that we used in the previous video just a message saying
exercise again very basic code but it serves for the purposes of this video and we're going to stay
alert
accesses and I'm going to try to sign the guest book.
And as we can see now I got the exercise here.
But the real magic happens when a normal person.
So let's just go home first and let's assume this is just the normal Web site and people just are coming
and browsing it and once they're going to go to the guest book javascript code will be executed on their
system from that Web site.
So the code is coming from that website and is going to be executed on every person that visits this
page again.
We're just showing a proof of concept here in future videos which show how to further exploit this kind
of vulnerability.