OK, we went through a bunch of different exercice attacks, but on our own SBW, a machine, we have
even more examples of different access possibilities.
And if I were to choose on which of these applications that we have available, on which one we have
the most examples of excess, I would go with an application B.
What?
On Boyup, we have most access examples, and I advise it to go through all of them just so you can
practice this vulnerability even more.
We're going to cover two or three at the beginning and then I will let you go through the rest of the
attacks.
So we're already familiar with this app.
We log in using B and Buck as username and password, and here we choose our vulnerability.
If we scroll all the way down here, all of the excess attacks that this application offers and they're
all different.
As we can see, this is an example of reflected get request access.
This is an example of posts request access.
We have Jason Exercice and have a bunch of others as well.
Towards the end, you even have some stored access examples.
Let's start with first three and let's see how we can solve them.
So let's click on Reflected Access, click on Hack and here's the application.
So enter your first and last name.
So let's enter first test one last name.
Test two weekly can go.
Nothing happens.
The only thing that changes is that it prints out while contest one test, too.
So both of these fields get reflected on the page.
We can try to inject both of them with our script just to see if they both
executed.
So let's alert hello and let's close our script, click and go.
And of course, we get two different Pop-Up windows for both of our alert functions.
So both of these inputs are vulnerable to the exercise attack.
Once you go through that one, we can navigate to the next one, which is post request access, and
in this one we get the same application.
Just if I type test one and test two, we get the same output.
But our parameters are not being sent within the link.
So we will not be able to inject our JavaScript code inside link.
However, we can still inject it right here.
Matter of fact, let's copy.
Our previous code, and let's go, and it will also execute twice on this page as well.
So this was rather simple, but these are also the attacks that we already covered.
But right now, I want to cover another attack with the access that we didn't encounter yet, and that
is the access over Jaiswal.
So let's click on that one.
Click on Hack.
And this is the application that we get.
So we have a single input.
It says Search for a movie.
If we type in movie named Test with click on Search.
Well, the output that we get is test free question marks.
Sorry we don't have that movie.
What if we try to inject JavaScript called our regular alert function search?
Hmm, it doesn't execute, but we do get this part of code right here.
Let's go to the inspect element to see where exactly is our script on this page.
So let's select this one.
Here it is.
So we have open script tags.
We have far or variable Jason response string.
And this could be a little bit hard to read.
So let's go and open page source.
Let's enlarge this just so we can see a little bit better and let's search for the alert function.
And here is the script that we are trying to input.
It's right here.
But it's not executing we have a similar example as in the previous video.
This part of code that we see right here is the part of code that is being written on the page after
we try to inject our script.
So how can we make this execute?
Well, the first thing that you should have noticed, because we did cover it in the previous video
is that in this example, we're already injecting our JavaScript code inside the JavaScript code.
We already have this script that's open right here and we also have enclosed right here.
So our input is somewhere inside.
So one of the things that we need to specify at the start is a closed script at.
We also have this very right here that starts with a single quote, then we have curly brackets.
We also have the square brackets, another color brackets.
And here where our input is, we have an open single quote.
So we must first escape this very we want to close all of these brackets in order to continue writing
our script outside of this Jason response, Trink, the easiest way that we can figure out which characters
we need to specify at the beginning of our comment is by going right here and simply copying these characters
set, all of these characters are something that we need at the beginning.
If we take look at the source code, we will see that these characters are corresponding to the open
brackets and also the double quotes right here and these single quotes right here.
And we also have this semicolon at the end to replicate the end of the line that we have in JavaScript
code.
After that, we want to close our scripts since we are inside of the script and we want to open another
script.
We can do that by running something like this and then alert.
Hello.
And we closed the script at the end, so this is our current Paillot, we have these brackets right
here, close cryptics, open script, tax alert function, and at the end, another close script.
Let's click on Search.
And here it is.
We finally got it to work.
So if I go to the source code of this page.
And they once again find the alert function, here is our code.
The Jason response drink is getting close with these brackets and the semicolon at the end of the line,
and then we are injecting our JavaScript code after recalls the previous script text.
Awesome.
As you can see there, a bunch of different examples as to how we can exploit access.
And I advise you to continue with the other examples right here to really grasp the concept of this
vulnerability.
Nonetheless, thank you for watching and I'll see you in the next lecture.