-: In this lecture and the next few lectures,
we're going to talk about a vulnerability called XSS.
XSS is short for Cross Site Scripting.
This type of vulnerability allows an attacker
to inject JavaScript into a page.
So JavaScript is a programming language.
And using this vulnerability
an attacker would be able to execute code,
written in JavaScript,
into a certain page
into a website.
JavaScript is a client-side language,
so when the code is executed,
it will be executed on the client, on the user,
on the person who was browsing the web page.
It's not gonna be executed on the server,
so even if your code results
into giving you a reverse shell,
the shell will be coming from the user
who is browsing the page,
and it's not gonna be coming from the website.
So any code you write in JavaScript will be exploited
or will run on the target user,
on the people who see the pages
and it's not on the web server.
So the web server is only gonna be used as means
of executing the code or delivering the code.
There's three main types of XSS vulnerabilities,
Persistent or Stored,
Reflected
and DOM based.
The stored XSS gets stored into the database,
so the code that you inject will be stored into the database
or into the page,
so that every time, any person views that page
your code will be executed.
The Reflected one,
the code will only be executed
when the target user runs a specific URL
crafted or written by you.
So you'll be manipulating some sort of URL
and send it to a target
and when they run that target,
when they run that URL, the code will be executed.
The DOM based results from JavaScript code written
on the client.
So the code will actually be interpreted
and run on the client side
without having any communication with the web server.
These could be very dangerous
because sometimes web servers apply some sort of security
and filtration to check for XSS.
But with DOM based the code never gets sent
to the web server.
So the code will be interpreted and run on the web browser
without even interacting with the web server.
And these will be present into websites
that update their content without refresh.
So we've all used websites where you put your username,
for example,
and it loads in straightaway
without having to check with the web server, or you do,
you put some sort of a string
and it does a search without communicating with a web server
or does something without communicating with the web server.
So if you're able to inject into that,
then this injection will not be validated,
so it'll be executed straightaway
and bypass all validations.