So listen, this we are going to see The Exorcist by Password's, so whenever when I first entered the
script, I read we got nothing.
Uh, we did not get even attacked because at first the securities I had you innocence with the DP back
and has appeared somewhere filters to avoid this scripted act to execute.
So let me show you how to bypass these security mechanisms that serve media and submit all the security
is media.
I can just to whenever whenever I take the script archive and then if I submit this, we just get rid
of it because our script, uh, they have some bypass filters.
So I did not execute and we do not see the box.
So I basically say the main bypass techniques you can use and you can also Google for access at once.
There are so many and so many blogs, so I'm going to show you the script.
So this is the obfuscation.
What are going to tell piece?
You want to mix the operators and the workers out of it?
Let's call this.
All right, did, said Descript.
No, I'm so right here to get a clear visibility.
Now I'm going to say a script.
Arato.
Now, I can just say.
Ersek Group.
So you don't need to worry about the exact matching of this progress in our case, we can do in a uppercase
lowercase apparatus, Apricus and so on, can just copy this letter and read pasted in here.
So if I submit this, I think we should, uh, get the red box.
If you had the source code, you can get this and you can see there is a black box.
Right.
OK.
They have given the source code red tape.
Uh, Nikki.
And let me just read the source code.
So what they're doing is they're using the speech we started off script with.
So when you type there is a script in this you order, then it will be replaced.
So you can see this one.
That's why we got the a lot of high the protection in the previous case.
So another important thing is know there is a quotation filter that you cannot pass the quotations in
the field in order, then you can use the string that from Carcoar function.
So what this does is it you take a bunch of ASCII dissimilarities and it will convert to the normal,
uh, ASCII values.
So that this one works and it will convert into the, uh, alphabet.
Let's see, ASCII table.
So if you go to the wall and you if you want to see a little fire, you need to, uh, find the hedge,
which is the smart one, unfortunately.
And so if you want to send the order to find it or not, for one comma, one zero five.
So think that's one.
So, OK.
Now, if you you can put this high inside of these quotations because we saw the first copy and it this
better it because it is so I know my bypass filter having the quotations filter so it's not allowing
the quotations to be executed.
So now would it be copied from Carcoar.
And so let me copy paste this.
If I copy and Piperno it will be like similar to String, not from Carcoar and the Sarasate will decode
this one, not for as yet or not for a fight as I saw it pasted in here and see if I can submit we get
the high.
So if you want to add another character, you can say, uh, let's say.
Well, another number to reach, a number that said forty eight at the forty eight, sorry.
48.
So if you can copy this old bird and post it in here.
And you can see how zero, so that's how you bypass these quotations filter in case there is a coalition
strategy during this trip, not from Carcoar function.
So this is about the medium security.
Now we are going to this high security.
Uh, let me give you the source.
So in this source.
I think so there is pressure characters.
So it's displaying the special characters.
OK, just let me try the normal script once.
Script of height, and then we just got the entire script.
So now what we can do is we can put the image that so I already shown you the syntax of this image,
like basically going to put David Sarsfield, which is also a need to specify the image.
But that's not the.
So there is no accurate depiction of Sarva.
Obviously, it returns an error.
So you can say honourary is equal to no.
We need to switch with the script function we have already seen on click a button on function in the
button that if I put this button, then the function of this particular script has been executed.
So in the same way, if there is an image and the source is an accurate in case the source is not available,
this JavaScript function will get executed because you are seeing on a rep acupuncture.
Now I can say are tough high.
Because this image so I can just simply copy and paste it in here on the face of it, this.
So let us know if you can see I have this program, I know we have seen about this, uh, access bypass
and I know we have felt that we got the, uh, medium term medium security exercise.
But what they have done is they have said this impossible fruchter exercise.
So you can see the source code here.
This is the exact source code of this, our special characters you can see here.
So this is the, uh, uh, security patch for this exercise.
If by using this especially its function, almost exercice use the word it.
So that's what they are saying.
And we cannot, uh, generate an alarm or any other dallas' could be because there is any special kurtas
function.
So now let's test this, uh, image tag under this, uh, medium security.
So we go to a medium now some.
All of this in here is a copy.
And there you can see, uh, there is a two are tough two, and there you see the image X.
It has not been found here, that's why honorable it has executed these are books, so this medium security
is based on this script.
It does not execute the script at all your character.
That's why we have used this image and we also execute this prosecution.
So the medium security is only seeing about this case a script that.
So you had this obfuscation and I messed up.
So in the high security, we cannot simulate the exercise because they relate specifically to function
and it is a solution to this exercise.