OK, we're starting off where we finished from the last lecture, we managed to bypass a simple filter
on our access, reflect the page, but right now we want to see how we can also exploit the excess stored
on.
So navigates to distort access.
And this is the application that we have.
It's a comment section.
We type in our name and the message Hello World, and we sign the guest book and it will add it right
here on the page.
We already know that these comments are getting stored on the server, so anyone loading this page will
also see our comment.
Same goes with the JavaScript code that we inject.
Anyone loading the page will also load our JavaScript code because we injected it straight into the
Web page storage.
Now, let's try it on low level to execute our JavaScript.
So let's go to a security, let me change it to low and navigate back to the store access.
Let's try to inject both fields, hmm, if we try to continue to type in the name field, it won't allow
it.
I guess it has some filter of how many characters we can input.
So let's just try to go with past thread here and let's inject our JavaScript code or our simple alert
function in the message field.
If I sign my guestbook and let me just load this a little bit more so you can see it better, then I
click on Sign Guestbook.
Well, here it is on low level.
It's really easy to exploit.
It has no filters at all.
And all we have to do is type in our script tags, alert function and it will run on the page.
Now, let's give it a try on the medium security.
If I type submit.
Go back to the store decks, assess we load our previous alert window because it's stored on the page
and now let's try it again.
If I take a test and a simple alert function between script tags.
Well, the window that we just floated was from the previous low level security script, if we managed
to execute this one, we would get to Windows and just so we can differentiate them.
Let's run the script alert and in this window, we're going to type in.
Hello.
Just speaking different from the previous script that's already stored on the page, as you can see.
This is not the one that we just ran.
It's from the previous attack.
The one that says hello is not getting executed.
Now, if we take a look down here.
It appears that that our script tags are getting removed and also we are getting these back slashes
before our single quotes, so it's getting filtered.
But let's try to inject inside of the name field if I type here, script
alert and we know that we have the character limitation, but let's just leave it like that for a moment
and sign the guestbook.
Our script tags appear to be filtered as well.
So what are we going to do?
Well, let's take a look at the source code of this page.
Let's see how it performs the filtering.
So this is the code of this page.
And we have a part of the code incentivizes the message input and part of the code for the name input.
Now, by looking at the message input code, I can already see that this is getting filtered a whole
lot better than the name input.
Why?
Well, because it has this HTML special chars function that removes all the characters from our message.
But this is not being used in our name.
We only have the same filter that we had from the previous video inside of our name input.
But we do have another problem.
We have character limitation inside the name inpart.
So how we're going to bypass that?
Well, we can do something like this.
We can type script alert and we get to the character limitation.
So in order to bypass it, we go inspect element.
We find this name input inside of our code.
It's in this form.
Let's open the table, open the body of this table and it's right here.
It's this line that I have selected.
And in this line we have max length equals 10.
So if we double click on this and change 10 to 100 press enter now I go back and I can continue typing
in this field.
Now I can type the entire script statement and remember, our script tags are getting filtered, so
we're just going to bypass it the same way that we bypassed it in the previous lecture by adding capital
letters script.
And if I click sign guestbook now, we'll load the first alert from the low security level.
And it doesn't appear that follow that this second alert.
Let's give it a try once again.
Of course, we need to increase this to 100 retype uppercase script, text and alert and let's just
differentiated by typing hello in the brackets.
Close the script.
We can type anything in the message since that is getting filtered.
Well, and we signed the guestbook.
Here it is.
Here is our alert script getting executed, we get our message.
Hello.
So it worked perfectly.
Now I want to show you another thing that you can do with access or with HTML injection in general.
You can inject a link for a file download, for example, for the purposes of this, I'm just going
to go back to law so I can inject it in the message field, go back to stored here without our two access.
And here I'm going to type test and to inject a code that will allow the user to download a file from
your comment.
We can type something like this, open APACS, a dress of equals, and in between the double quotes,
we specified the link that will lead to the file that we want the users of this page to download.
So for the purposes of this, what we can do is we can, for example, go to this info copied path to
this file, let's call it.
Go back.
And paced that path right here between the brackets, so open attacks, a Trev equals this link and
now we want to type space download oops.
We also have character limitation right here so we can bypass it the same way that we did previously
by finding that in our HTML code and increasing the max length to a hundred.
Now, if I type download till the end, it will work and I close the tags and type the filename so the
file name can be pretty much anything that we want.
We can just call it pop info dot.
We close the attacks at the end and we signed the guestbook.
Let's click on OK.
And here it is, we injected a link for file download.
If I click on it, it will ask me whether I want to save this file on my PC.
So that is also something that you can do with this vulnerable input.
Whether you inject an HTML code that will download the file or JavaScript code that will download the
file, it doesn't matter.
What matters is that the possibilities with this are limitless, especially when you can inject JavaScript
code.
OK, awesome.
Now that we covered both reflected installed access on the TV.
Let's take a look at the DOM access on our Motyl the page in the next lecture.