Now let's talk about how we can prevent access as vulnerabilities the way these vulnerabilities happen
is because whatever a user enters something into a text box or into a parameter that input is displayed
into the hasty e-mail so is treated as if it's part of the page and therefore if there is JavaScript
in it the code is being executed.
So to prevent this exploit the best thing to do is to try and minimize the usage of untrusted inputs.
So anytime a user input something or a time sometimes input from parameters tried to minimize that.
Also make sure that you always escape wherever that's going to be displayed or used into the hasty AML
page because exercise cannot only be injected into places where things are displayed on the page but
it can also be injected into parameters of certain elements of the ACMA page.
So what I mean by escaping is converting each of these characters to what they would be represented
by and hasty AML.
You can do that using scripts and you can do that using your own script.
Now let me show you how this happens.
Now I'm here at my vulnerable Web page that we were using and I'm going to go to this third one and
obviously you can see that every time we click on that the access runs.
So let's inspect this element.
Now this element is where we injected our alert.
And if we right click and go on inspect element it will show us the hasty M.O. of this page or the ECMO
of this particular element right here highlighted so I'm going to make this bigger and if we look at
it right here you'll see that we have the name and that Zayd and then the other input which is the message.
It's a script and the script what the script does.
It does alert exercise so it's exactly what we injected into it when we did the comment so every time
we were on this page this piece of code gets is executed.
So we need to do is we need to make sure every time a user enters something and that something will
be displayed on a page or that something will be used somewhere in the elements.
So even the idea here or even the H.
The idea is just for example is a parameter of the div it's not the you never see this idea but this
is this can be injectable it can be injected as well.
So hackers can actually try to inject stuff into the parameters.
They can try to inject stuff into the image attributes for example.
They can do an image and inject stuff into the sauce or into the URL.
So this is just an example here.
And every time a user's input is going to be used anywhere on the page.
So even if you don't see it if you usually don't see it you need to make sure that you escape that input
and make sure that it does not contain any code and if it contains any code that it's converted to an
equivalent that the code will not be running so it's converted to its hasty ATP equivalent so that you'll
actually once you escape this you'll actually see this in the message.
So you see the message as script alert exercise but it will never be executed.
This script will never actually be executed on the target person when they run it.
Now as a user to prevent yourself from being used into an exercise attack now you are all coming to
you will probably look like a you are L of a trusted Web site.
For example let's assume that you work in a company and there it was an exercise in your company and
you are logging into your company and the code gets executed on you then there isn't much you can do
yourself.
What you need to be careful so would be if we saw in order to exploit the vulnerabilities we were shown
for example a fake update.
So make sure when you if you get an if you get a message always that there is an update.
Make sure you actually go to the Web site that provides that application.
So Firefox said that there is an update go to the FAA to the website of phase of Firefox and see if
there is actually an update and if there is downloaded from that Web site don't downloaded from the
notifications that you got.
Also make sure you're downloading it from a hasty CPS Web site.
And once you download it you can inspect it and check it the same way that we seen before to make sure
that there is no back doors or anything in it.
You can also check the MDA five some to make sure that the file hasn't been manipulated while it was
being downloaded the same when we did the fake Facebook log in when you were with beef.
So what you can do is whenever you're told that you got logged out and please log back in again ignore
that go to Facebook dot com.
Make sure it's going through CTP G.P.S. and then log into facebook so always try to be careful with
notifications popping up telling you you need to do stuff.
Always be wary and never trust the.