Welcome back.
Now I want discuss I reflected excess on our DV w a page.
Now, there we have a certain level of security that we can set and we're going to take a look at how
we can bypass the medium security level on this page.
The reason we're not covering the high security level is because in the latest updates, high security
level is said to be impossible to hack.
It's actually set to the correct code as to how secure pages would look like.
Let's go to our TV w a let's begin with admin and admin.
And here we first want to check what security level will have currently we have low.
Let's leave it like that for a moment and let's navigate to the exercice reflected.
So we get a simple application, it asks for our name if we specify best.
Our usual string, it says hello test, so we already see it's getting reflected on the page and it
becomes interesting for us to test for both the email injection and access.
Let's try with a simple alert function, so let's alert hello and let's close the script tax.
As easy as that was, we get our alert window pop up right here that says hello.
OK, awesome, but let's give it a try on a medium level, will that same example of work on this level,
if we change it to medium and submit, then navigate back to access reflected in typing the same thing?
Close the script and I submit.
Hmm, we get hello alert and hello inside of our brackets.
But where our script tax.
Well, perhaps they got filtered in by this output, we would assume that they did indeed get filtered
and removed from our input.
If we want to cheat a little bit, we can take a look at the source code that will tell us exactly what
this page is doing in order to filter our input and for practices that would be a good thing to do.
Let's open this up code.
And if we take a look at right here, here is where filtering happens, we're getting our script tags
replaced with nothing.
Hmm, interesting, but we can't run our JavaScript code without the script text, so does this mean
that this is a secure input?
Well, not exactly if we tried to do something like this.
And we type in capital letters, script and then alert hello, and we close capital letters script.
We submit this.
Well, this worked, we only change the lowercase letters into capital letters, and it managed to bypass
the filters of this page because by their code they're only replacing lowercase script tags with nothing.
If we type uppercase script tags, then it will work.
So how easy was that and believe me, many pages have this type of a week filter where they only filter
some things and not all of them nonetheless.
Thank you for watching.
And in the next video, we're going to take a look at the store access on the eight page.