Now onto stored cross-eyed scripting and this is the big one right.
This is where you really can prove impact and you can make some good money when it comes to bug bounties
as well.
If you think about this.
So think about it.
In this sense say there's a comment form or something out there and you post a comment in that comment
can affect an administrator you as a regular user can infected administrator.
Now you as a regular user have stored this vulnerability that steals cookies you steal the administrators
cookie you hijacked the account and you log in as the administrator.
That's how this can become very dangerous very quick.
When it's stored.
So here we're going to look at what we were looking at last time and actually let's go back and go to
the scoreboard before we move on and we're going to just grab the payload recommendation.
OK so go to the scoreboard and we're going to say OK we're after the classic store.
So it says perform a cross site scripting attack with script alert cross-eyed scripting script let's
guide and copy that and I'm going to point you a little bit in the direction where we already were.
Let's go to our account in our testing profile and let's try to set our user name using this payload
and look at what we have as a payload and look what returns.
All right so we've got script L E R T X s OK.
Well what just happened.
They took off something right.
What did they take off.
They took off script.
So I'm going to space this out here to me what this looks like is it's filtering this whole thing right.
It's filtering script a So we need to think about how can we maybe bypass this and there's a few different
ways that we can do this.
But what we really want to do is we want to say hey what can we do here to where we can start.
This have something maybe filter out because it identifies it and then maybe because it doesn't identify
the rest then we can go ahead and just you know put the rest over here and I wonder actually if I delete
this just here and I say set username does it keep that.
It does.
So it's looking for something here very specific that it's going to filter out.
So why don't we do something along the lines of maybe I don't know.
Let's look at this.
Let's say we put our our script back in here and we'll just close this out make it look like it was
and then let's go ahead and just put script a back in here right.
So what's going to happen is it should say hey I've got this built in mechanism security mechanism that
gets rid of script day and then I'm going to go ahead and just leave the rest.
But guess what.
When it leaves the rest this is all going to fill back in or should let's go ahead and take a look.
How.
Look at that stored cross-eyed scripting OK.
So it is now stored here.
OK.
And that's really cool.
Look and it says classic stored.
We go to actually accountants take a look.
Oh it's there again.
This is stored cross-eyed scripting.
I love this stuff.
So this is a classic classic example.
And I love this one because it shows you a little bit of thinking outside the box.
And once you get into web application pen testing and you really start to dive into the weeds you're
going to understand a little bit more that you know there's all these different kinds of office station
that you might have to use in order to actually execute these payloads in something that you might need
to think about is running something like this maybe through burp intruder say you you have intruder
here and you or a proxy we intercept that we say set username we come in here and we send this over
to repeater.
And then in here maybe we'll say we're actually sorry we send this over to intruder and over here we
say go ahead position.
I want to set this specifically and then I'm going to go ahead and run payloads here.
Well how do we get payloads.
You know we just go to Google and that's going to hang because we have the proxy.
We just go to Google and we say something like cross-eyed scripting payloads.
I literally do this.
This is this is what I do.
OK.
So this is my methodology spot on.
You come here you click the first one on github or one of these other ones that you might want.
Look at all these different ones here.
You can copy all these come through.
Try to grab it you know and see if you can't get one of these to pop.
So food for thought how you might try to get this to work and even like things like this.
Look all these different obfuscations look at this one here OK.
It's using you know uppercase and lowercase because maybe it's just looking at that lower case script
a.
So we can maybe try that one or they start getting into you know these weird H2 mail inserts or you
might even have like you are L encoded and these all look very different and you'd be surprised something
like this.
I've gotten something like this to pop before just because it's obvious skated more so than you know
just a regular type of the regular type of payload that we would use.
So as a test I've actually never tried this out before.
Let's set the username like this and see if it works it doesn't.
So it's actually converting this to lowercase or it knows how to filter this out in the first place.
So good on them but again thinking outside the box here is just the way to do it.
Having these payloads maybe firing them through intruder and looking at how they look what they might
you know what the responses are and how it might store is always another good move as well.
So just keep your wheels spinning.
Go ahead and go do that Dom base cross-eyed scripting next.
Once you have all those through go ahead and meet me in the next video and we talk about the defenses
and what we can do to prevent these kind of things.
And then from there we'll move on into the next vulnerability.
So I'll get you over in the next video.