Welcome back.
Now that we learned what excess is in theory, let's see different examples of how we can use and exploit
the excess vulnerability.
We're going to start off, as usual, with our tri hacking platform.
So I already have my machine started right here.
I have navigated to task number 20, which says cross site scripting.
And we have a couple of options right here or a couple of tasks.
Sure.
They say we have to solve all of these challenges.
And I also advise you before you do that, that you can read through this theory part right here and
maybe learn a thing or two more about access.
Nonetheless, once you do that, copy the IP address of your virtual machine and paste it in your browser.
OK, so we got a simple page that has a login form, a registered form, and it has some options right
here where we can go to reflected access or stalled access.
Let's see what our first task is.
The first task is to deploy the VM.
We already did that.
The second task is navigate to our IP address in your browser and click on reflected access tab on the
navigation bar craft, a reflected access payload that will cause a pop up saying hello.
OK, this sounds like a simple task, so let's go right here and let's navigate to the reflected excess.
As we can even see right here, our task is to create a payload that will pop up a message that says
hello and we can do that with the help of a JavaScript alert function, the same one that we covered
inside of our theory video.
So all we have to do is let's first see what would happen if we might just test.
So it will reflect it right here on the page.
It will say you searched for test.
Now, if we type our JavaScript code and the function that we used is once again alert in order to specify
the alert message, in our case, the message will be hello, because that is our task.
And we close the script tags, we click on search and here we have and access it when our JavaScript
code and open this window that says help.
OK, let's click on OK.
And we get our flag right here.
So this is the Flag Tower Challenge.
Let's call it.
Let's go back, specify right here and submit it.
OK, let's close this and let's see what our second challenge is.
So on the same reflective page, craft reflected EXIS payload that will cause a pop up with your machines
I.P. address.
OK, so we pretty much use the same user input, so we know it's vulnerable to access now we need to
run a different JavaScript code in order to pop up an IP address of the virtual machine.
We can do that by typing this script right here.
And let me just zoom to just so you can see a little bit better.
We run script and then inside the script tags, we type alert.
And in between the brackets, we specify window, dot, location, dot, Postnet, and of course, at
the end we close the script tax.
So this is how our script would look like in order to prop up the IP address of the virtual machine.
Let's click on Search.
And here it is, we get it right here.
Click on OK, and we will get our flag, which is specified as a result for our challenge.
Let's go right here, paste it submitted and that one is correct as well.
The second thing or pardon me, the third task that we have is navigate to the same IP address in your
browser and click on Staat Access and we also need to make an account.
So let's do that real quick.
Let's close this navigate to store access.
Remember, the reflected Exercice only reflected our JavaScript code on the page.
It didn't store it on the server.
With the stored access, we're going to see an example of our JavaScript code being stored on the server.
But before we do that, let's register as a user with type test and as a password we can use test.
One, two, three, four.
Let's register.
And we are currently signed in as a test user.
Now, we could have maybe used an excess on this part right here as a username because it does get reflected
on this page.
But this is not a part of the task.
That is something that you can try after we finish this video.
For now, we want to navigate to store the access.
And it appears that we have a simple Commons application if we type hello right here.
Post a comment.
Here is our username and we said hello in the chat or in the comments.
Now, let's see what our first task is, we want to add a comment and see if we can insert some of our
own HTML so we are already comfortable with HTML and an injection.
So this is probably something that we know we can try to type.
Open header, text test and close header text.
And here it is, we also have the HDMI injection and the answer for this question is this html t for
G.S..
Let's specify as the answer right here.
And let's move on to the last two challenges in this video.
So on the same page, create an alert popup box, appear on the page with your document cookies.
Well, we already know what we're going to use the same alert function.
So let's open our script tags.
And in between the alert brackets, we want to specify document dot cookies in order to alert us with
our cookie values.
We, of course, need to close the script tags.
And once we submit this comment, we get our cookies right here.
And this is also stored access, we will get our result rebel flag right here, which for some reason
I can't seem to copy.
Let's try it like this pasted.
And it works now if I refresh this page, you will notice that due to this being a store excess, this
will pop up every time I refresh the page in, not only every time I refresh the page, but every time
someone else visits this exact same page, they will get a pop up with their cookie value.
And that is because this is a stored access.
A stored exercise gets stored on the server.
And this valde right here of our HTML injection and our value of our JavaScript injection or access
vulnerability is also getting stored on the server and loaded every time someone opens this page.
And that is the difference between the reflected exercise installed axis.
This one we can say it's a little bit more dangerous because it's getting stored on the server.
Now, let's go with our last challenge, it says Change Access Playground to I am a hacker by adding
a comment and using JavaScript.
We have the access playground right here and we want to change this into I am a hacker.
This can be a little bit tricky.
We want to find the idea of exercise playground and we want to change it to I am a hacker.
We can find the ID by going to inspect element.
Then we want to navigate to this part right here.
And it's in the navigation bar, lower that, open our tip tags, open our attacks for the access playground
right here, we should be able to find the idea of the access playground.
And it's right here.
In this light, the ID equals t h m dash title.
So that is our ID.
Now we want to call it with our JavaScript injection.
So let's go down here, open our script text.
Let's type document dot and we're going to use query selector, and in between the brackets, we specify
the idea of our axis playground.
Since that is what we want to change, we need to specify in between the single quotes.
Then we add a hash and then the name, which is t h m that title.
So we change it like this, then we had thought and then text content equals and now we specify what
we want to change it for our challenge, we must change it to.
I am a hacker.
And at the end, we close the script tax.
So this is our payload, if we specified everything correctly, it should change this axis playground
into I'm a hacker.
Let's click on comment.
We get loaded with these values, and for some reason or never mind, it worked, we managed to change
it and now it says right here, I'm a hacker and we successfully completed the challenge.
If we take a closer look at this page, we also get this right here, which is our flag.
This is a flag that means that we successfully completed this challenge.
Let's specified right here and let submit submitted.
OK, awesome.
I do admit this last task was a little bit harder, but we managed to get through it.
We use the Querrey selector and then we selected the idea of the thing that we want to change and we
use the text content in order to write the I am a hacker sentence.
Awesome.
Nonetheless, we finished with Tritak, my example of access, and we're going to move to access example's
inside of our BVA virtual machine.
See you in the next lecture.