Welcome back.
Let's take a look at a different usage of HTML injection and what else can we do with it once we find
it out?
Well, let's take a look at a different example this time.
So in the last video, we injected our HTML code in the user agent, HTP Heathfield, and that is when
we found out that it's possible to inject the code without having any user input field.
We just intercept the request in our burset and we injected the code in our user agent field.
Now let's take a look at another example.
So navigate once again to USB metadata.
Let's go to the HTML injection and let's try this one HTML injection via cookie injection.
That is the one that we haven't tried yet.
So let's go and capture data page and let's take a look at this page.
So once again, we don't really have any user input field that we can type our HTML code, but we do
get this printed out.
And if we take a look at a little bit closer to here, we will have this data or this string written
on this page.
Now, what does this look like?
Well, it looks like a cookie Bilu, as we can see, session ID and then we get the value right here.
So could it be that our cookie value reflects on this page, but we already know how we can check that
we can simply just intercept the request inside of the burset.
So let's reload the page and here we get the request.
Here is the session ID and let's compare these values right here.
And that's pretty much it.
This is getting reflected on this page, so we already know how it would go about doing this.
We will just inject our code.
We would reflect the code on the page, and we would conclude that the page is vulnerable.
But let's try to inject something else than just the HTML headers.
Let's try to redirect this page to Google dot com with the help of HTML code.
So how we can do that?
Well, we can write this code.
Let me just open NENO real quick html redirect code dot deep code of text and we are going to write
this code.
So open tags, meta http dash equiv equals open double quotes, refresh codes, double quotes, then
let's add space content equals five.
And we're going to explain this in just a second.
It's rather simple.
Then semicolon and then Eurail equals https.
Dash dash w w w Google dot com close double quotes and close the HTML text.
So what are we doing right here?
Well, first of all, let me just delete these two dots.
We don't need two of them.
One is just enough.
And what this code does is it refreshes the page where we inject this code and redirected to Google
dot com.
And this content equals five is simply just the amount of seconds that it's going to wait before it
redirects the page.
If we write five, it will wait for five seconds and then it'll redirect the page.
If we set right here one or zero, it will redirect it straight away.
So let's give it a try.
Instead of injecting HTML header sites one like we did in previous video, let's try to inject this
under the cookie value.
Inside of our request and here it is.
OK, let's forward this.
And let's turn off the intercept navigates right here, and in five seconds, this page should get redirected
to Google dot com.
Here it is.
We didn't type anything either redirected automatically due to our code being processed as an.
Now, if you want to, you can do this, but with a quick injection captured data, let's intercept
the request and let's refresh the page.
You can also do this straight away.
You don't need to wait for five seconds in order to redirect the page.
All you have to do is navigate to the content and change it to zero, then forward the request or turn
off the intercept, go back and it will get redirected straight away.
How cool is that?
OK, so this was another tag that we could have done with the injection, we can simply just redirect
the page.
And we also saw another way that we can perform the injection, which is through the cookie value.
We change the cookie value with the code and it got executed because it got reflected on our page.
So in the next video, we're going to take a look at another example of the injection and then in a
video or two, we're about to move on to the next more serious and dangerous vulnerability.
See you in the next lecture.