Welcome back everyone.
This saga from a degree and in this lecture I will talk about what is excesses excessive stats for cross
site scripting.
Now there is a rule in web development or any kind of development that never trust a user.
Right.
But mostly developers forget this.
They think that user is a legit person excesses occurs when the application is not validating and sanitizing
the input.
This myth seems complicated.
Let me just give you an example.
When you see the DV w a reflected excessive speed you will see that there is.
What's your name.
Right.
And there is a field where you can enter your name.
Let's say I enter saga urban so
you can see submit and it shows you Halo saga bonds.
So think about how the application is working in the background.
Right.
This is taking a value here that value is being combined with Halo.
And then the value and the result is being printed out on the web page as it is.
Now the security failure in this application is that this application is trusting the user that user
will only enter the name here.
But if I add some payload or malicious code that will damage the whole Web site or any kind of code
injection that will do something malicious.
If you see the source code of this website let me just Sillman you will see that echo halo and get name.
So there is no security at all.
This is one line PSP code where it is simply printing the value of its user is giving and this gives
rise to the access.
If I give some malicious code instead of this name in this value if I give some malicious code it will
execute that code on the Web site without checking anything.
And it can be a high level vulnerability in some cases.
So in the next lecture I will show you how you can find and exploit excesses till then have a great
day.