Welcome back.
Let's discuss a dorm based access.
So in the previous few videos, we covered a couple of examples of reflected and access.
We also saw some of the possibilities, such as stealing cookies, getting the IP address, changing
the contents of the page, and also injecting a file to download.
We also bypass the filters that removed our script tags and we managed to bypass the Mac's character
security.
Now let's navigate to the password generator in access vulnerability.
You can do that by going to all WASP, then navigating to cross site scripting and under the term injection
you want to select password generator.
And this password generator, once we click on this simple button, generates a random password every
time.
Now, the first thing you will notice with access is that if you tried to intercept this request, it
will not work.
You're not going to intercept anything once clicking on that button, even though the intercept is turned
on.
That's because no requests are being sent, as we can see, nothing is happening, so we can turn this
off.
But if we take a look at closer at the link, we'll have this username equals Anonymous, so let's try
to inject it.
If I type our usual alert function by opening script tags and closing script tags, press enter.
Hmm, it doesn't work, at least we think that it doesn't work, we didn't get the pop up window, but
what we did get is this part right here and this looks like a part of code.
So let's try to find in the source code, where exactly is this located?
Let's open page source.
And let's copy this, for example, and let's try to find it right here.
We can't seem to find it.
Let's try just finding it manually.
Or we can try to find all of the alerts on this page, here is one alert.
Here is another alert and here is where our code is getting injected.
This is the error message that we get, as we can see right here, and this is our code to inject it.
So it's still getting there.
Just it's not getting executed.
Let's see why it is not getting executed.
Well, if we take a closer look at this part of the code, we'll notice that we already have open script
tax.
So our JavaScript code is actually getting injected inside of a JavaScript code.
That means these script tags are not needed or we need to specify close script tags before we open them
to run our ad function.
So how can we bypass this?
Well, since we already have open script tags, we can just first close the script tags for this part
of JavaScript code from the page, and then we can open the script tags once again to run our alert
function.
Let's give it a try.
If I go to this page.
I delete my previous payload, what I'm first going to do is I am first going to close the script text
and then I'm opening script tags right after, then typing my alert function.
Let's specify hello as pop up message and I close the script tags again.
So this is how our payload looks like right now.
If I press enter.
Now it's getting executed now we managed to run our JavaScript code by closing the previous JavaScript
code and opening the new alert JavaScript code.
Let me show you how that looks like.
Now that we ran it successfully, let's try to find our alert function once again.
And here it is, as you can see, the script tag that is getting opened by the code itself is getting
close by us right here.
Here is our closing Riptech.
And right after we did that, we opened another JavaScript function that will run the alert message.
Then we closed it.
And the thing that we see outputted right here as an error is actually a part of code that we get right
after we close our script, because this is no longer belonging to these JavaScript script.
This is getting processed as a regular text on the page.
Therefore, it's getting outputted right here.
So we managed to execute our JavaScript code by taking a look at the source code and seeing what we
need to adjust in our payload in order for it to be able to execute us.
Now, that video that we're going to take a look at, another example of access or a different example
of access in the next lecture.