So that's an issue that we're going to see this, um, reflected in the store, that success in the
small, uh, W stands for down over our Web application and using this admin.
And the password is password.
So now you can see some of these exercises here on the left click on this exercise.
So now what we can do is it's asking for what's your name?
Nicole Coates's.
Hello, Nicole.
Right.
So now what we can do is we can train for, uh, uh, accessors we can train for any group and see whether
it's reflected in our website or not.
So let me open a notepad, so let me take the normal script, so to execute the script, we need to
encode the script in a script, right.
Let's alert off.
So this alert will pop up in a lock box.
It's a high.
So let me go over this and be it in here and know if I submit this.
And you can see Scriptura tight, so, OK, my period did not get executer, so let me know this and
putting the security law in the next year, I will show you how to bypass this exercise just using some
techniques.
So now let me take this one and submit and you can see the results are boxing the height for Kirkuk,
then you can type Nikil and it is hello.
So this is called Xerces Reflektor because it's just refracting whenever you sending Peladon, you can
see here.
And if you submit this, you can see in the you order it says a name has the value of our dollar script
code so you can copy the seawater and send it to your friend or somebody and they will get the height,
but it will be only refractor, it will not get entry in the database.
So now let me go to the store and there is this form.
You need to type the name and intercept message.
That's a good morning and let me sign in.
So now this is saying that name.
Good morning.
So what we can do is we set our tempo.
Let me pass this same payload, which is a lot of read in this book.
So it just right now.
OK, now let me just refresh this bit and see what happens.
So, OK, I'm going to home, OK?
Now I'm going to visit this exercise page.
As you can see, whenever I click on this, I get the high because it this is a shoulder exercise and
whatever I whatever I send the in the previous a message, which is this payload will attach to the
entry in the database.
So whenever I wrote this page that corresponding JavaScript will get executed automatically.
So even when you are an anonymous user, I mean another user, when you click on this axis, you get,
uh, you'll get this, uh, downscale printing.
So this is the difference between Reflektor and stored.
Now, let me go to the set up and reset this database.
So now what I want to show you is I want to show you another technique that is to rewrite the Web page
so you can see some of these hackers posting like website defensing.
We have the Pakistan websites.
We have got another country's Web sites.
And if you go to those Renk, they will they will say the integrated Choma and you will see how could
wait this week, uh, XRX or something like that.
Uh, you think the website is accurate, but did not they just are redirected every other tree to this,
uh, hacker.
Uh, some custom I will show you.
So window dot location dot hypertrophied.
We put this in the uh, if there is a vulnerability in the Web site, you know, if you put the script
and get to do good, then your browser will this page will never get to this hyperlink reference to
Google.
Dot com.
And let me quote this, I'm sorry that because this group.
And let me copy this.
So I'm for showing you how it will be best, and if I submit this, as you can see now, I have already
I got automatically redirected to Google dot com because it's because of this we that a location but
so good place this window with this, uh, hypergraphia, which is guru.com.
So let me create this.
I hope we have understood whatever you put this creperie to get executer.
I know you can also put the document or cookie to get the cookie, but I will show you the cookies during
in the studio after NextRadio.
So now let's go and see the expositional.
Let me take Google and know I'm going to copy this up here.
It just we know the location of.
So we read the script.
Sorry.
OK, I think it's just.
So I would expand this again to make.
So today.
So OK, no, yes, it's just there, but it's structurally sound in this guestbook.
I don't know why it's getting truncated, OK?
Let me, uh, Manuel.
All right, OK, I'm just getting tired of this, I don't know why that input is getting stronger.
This is the text to accept.
OK, let me open this.
So all these connections, you can also intercept these requests in the past and you can edit there
also look at all the action.
You can take this one or this one is to one and you can pursued also.
But just for simplicity purposes, I also do in the broader reserve.
But no, this textbook is not showing me in put.
It's just truncating.
Right.
So there may be the Dallas script or any this limit or the next Starbury.
So this is a better time to show you the Batsuit how to intercept.
I have already shown you, but just in a practical way, not so much in terms of design.
So whenever there is a script like this in a concert which is not allowing you to type some characters,
you can just intercepted person.
So let me say, Nikil, let me let me say hi signing this.
And you can see the request here.
And instead of this message, hi, I'm going to copy this here.
Now you can see my full screen.
Peter has been successful.
I can say, oh, forward.
OK, yeah, I read my script, let me take another fruchter, I go.
Gates, this group has not been sending all this
over this year.
Maybe that's why we're not getting reduction.
Let's try another time stamp and at the end of this.
All right, let me put it in here.
So now order for this.
So, Carol, just the request has been brokered before, which is created a new line, so, no, I just,
uh, dated the, uh, Backspacer.
So now we have successfully rerouted to guru.com if I go again.
So now I need to, uh, do the pilot again.
If I go for this exit, I get a little guru.com.
So that's how you will see that you will do the page.
Dessaix defacing.
So what are you going to use?
You need to first upload, uh, file to this server and what are you gonna do?
You know, that is not true.
And the path to this chamber, you have a circular com slash.
Uh, the index started to accomplish.
So whenever you just going into it for the world, it will be redirected to this.
Uh, I tell you how to play so you can see the store and you can see guru.com.
So that's how you get the reaction.
So I hope you have understood what this will do about this.
Understood.
Exercice.