So now we are going to steal some cookies from the user using this exercice vulnerability.
Let's go the spirit over here and let me login into this admin and pass for.
So now I logged in, let's see the draft, pick me, write the sample script together to make sure that
we are getting the there is access.
So a lot of high.
So I copied and pasted in here.
So let me turn this to to law, so actually I want you to watch it, uh, this only this, uh, kettling,
so that when we put the security law and the full house bypassed this filter so you can apply this matter
and you can see there is a, uh, Dallas group executives are boxing.
Right.
OK, I know what I'm going to do is I want to, uh, print out this document that.
So this is a document object.
We can access this, uh, current document, that kookie.
So if I say like this.
No, my cookie will be displayed.
So security is equal to law, society is this one sees around five.
OK, now how can we send to a commission so far that we need to set up a server in order to install
Apache or some other advanced software for this?
You can use this Python three and there is a module cartridge to tip that server.
You can simply set up a Web server on the spot, say, one, two, three, four.
So now we are serving.
This had to depend upon all interfaces.
One, two, three, four.
So if I go and check my IP address, I have this one so we can send the request or we can post these
requests to this IP address and we get the result here.
So let me, uh, show you this one.
So in script, I would say type is equal to or Eckstut JavaScript.
So we have seen this type ecstasy assist texta A.M. and the our studios.
I can say that.
So now inside this can be considered as a text or JavaScript.
Now what I can do is I want to delete this one.
I want to document.
Uh, but, uh, sorry.
Document that location.
Is calls to the GDP current slash and.
Now, I need to put the this Kleenex machine, which is 192, that right one, not for current one,
two, three, four, because my Web server is running on this board.
One, two, three, four.
So me make sure my borders and ports are OK.
So one, two, three, four.
And IP addresses one of the twin.
And know, what we want to say is we put the question mark stress and then question mark resurveyed
name is cookies is equals to press.
We need to include this document, that cookie.
Put this in corner then.
So what I'm doing is I'm taking the whole Duquan solution to this IP address and what I'm going to do
is I'm sending a parameter and the value in that parameter is the name of this parameter and the value
is Buchbinder.
So I'm just sending this document in a parameter just like username and password.
So let me go with this and run this.
So far, click on Submit.
We can see here we got the Dataquest, the trash cookies, we got everything.
So what we have said is cookies is equal to this whole cookie.
We have seen in the previous script that these are tough cookie so we can see securities galore.
This session is good.
This one, this is all cookies we got in this.
So this is a basic where you get the cookies using this python server.
But there is a good way to get these cookies by using some python, frasca, Django.
Or you can also if you know PSP, you can just write the simple typical.
So this is I don't know that much I know python jungle, but we do try to call jungle in the U.S.,
but it's not necessary and necessary, but you can use for comparable purpose.
So you can also set up to actually be server like this python three a.m..
This is a simple and a neat where you get the cookies.
You know, I can copy these cookies and paste it in.
My other brother and I will get that login.
So let me try this.
So let me go to my room here.
One nine one nine two.
So, David, over here.
So there is already a health insurance exchange that is called Key Ed again this year.
Can just pasted in here.
So I need to promote this or this, and I want to call this a green sticker on.
So my cookies have been sitting on this page, I see nothing, let me see cookies, OK, no, I want
to moving in to this tree, so order Tree Hill previously vulnerabilities.
So let me move on to this vulnerability's.
And let's see if we can log in without using the password.
OK, let me click on this.
And there you can see we are locked in, as you had been, uh, Scooter, along the way, we have locked
in as we have stolen the key of the admin user, because you can see this is the admin and we have logged
in as that user because we have just posted the cookie in here and we have successfully navigated into
these vulnerabilities.
And without logging in with username and password, we had already got the section of this admin.
So I think you have understood.
So you can just, uh, spin up using the python and then you can just, uh, send the document, that
cookie using this, uh, another document, that location.
And then you need to start JavaScript for make sure that this is interpreted as to document the.
So this is the basic to the police.
I hope you understood so that after this video was stealing cookies, using exercise can see this exercise
is very dangerous.
It used to trick the user using, uh, this, uh, uh, script.
Even you can, um, obviously, you can get the cookie of the user.
You are going to try and you can just impersonate adult.
So this exercise is very dangerous that you can just get the section of that user.