Welcome back everyone.
The sad saga from a degree and this lecture.
We will talk about excessive stored so till now we have covered the excess as reflected which occurs
through the vinyl or the SDP barometer.
But what if the application is storing the request in the database.
Let us go to access a stored.
But before that change the security level too low
now here too you will see that there is the name.
Let me add my name here so seems like there is a character limitation I cannot add E L here.
So let me just remove this and there is the message Hello.
And let's say I press this thing you will see that this message has been stored in the database of the
website and it is being rendered on this page from the database.
If I go to some other tab and I come back on the access is stored it still stays here.
Right.
There is no you order in this case but there is the database in the world.
And that's fair.
The stored accesses comes into deeply when you go in this source page you will see that there is a minuscule
database connection which is actually taking values from database and rendering them on the page itself.
Right.
So to exploit this kind of thing what you do is you test both of these fields.
First of all we will test the message field.
Let's say we test this field.
So this is our payload.
I add saga here.
That's right.
To test this the message field is infected with the stored accesses.
Now whenever someone opens this speech let's say I am on this page and whenever I open this page stored
DECODE AUTOMATICALLY renders.
And that's where this one disability comes right.
Let's test this thing on.
Name as well and you will see that there is the character limitation.
So we will remove this character limitation right click inspect element
and when you go here you will see that the maximum length is 10.
Let's change it to one hundred and ten presenter.
Now this should have been changed let's try to add this now and you see we can type it and I will see
high in this case.
Let me change this.
1 2 2 let's sign this.
Now this first one has came due to the result of this one which we added earlier this second excesses
is coming due to the result which we added in name right now.
So both of these fields are infected with these stored accesses.
Let me do one thing.
Let me go in the Reset database and reset this whole database so that we can again test this.
So I'll say you said database and it has been resettled.
I can go and access is stored and you will see now everything is back to normal.
Right.
Let's change does David W. security to medium
and again when you go in the store accesses you see names saga and let's see message here.
When you tried to sign in it won't work because it's the same procedure it does trying to filter the
script tag but I can see script tag and I can give some variation in this that's a B I mean I can give
variation and this one lets it s and I can then try this thing and it doesn't work either.
So seems like they have implemented some more security let's try to do that in the name tag inspect
element
we go here during 10
we try to give the variation here.
Let's see this thing.
Let's try to sign in and here you go.
So basically in this case message field is not infected with excesses but Name field is still infected
with the excesses.
Let's go ahead and reset the database
let's change the security level to high this time
let's go in the store it accesses and let us change the maximum input.
Now let's try to add the tag in both of these so I will give a variation to S. And this one as well
as you can give any variation it doesn't matter.
We just want to make sure that the script tag is not being filtered
Now let's try to sign in.
So if there is exercise in name it should pop up with one if there is access as in message it should
pop up to you sign in and you'll see that there is no pop up at all it means that both of these are
using some other security mechanism or they are not infected with excesses let's try to use another
element which was body
so there is again the limit.
Let me just change the limit here
I will give the attack as its own load attribute equals and here I can give my payload so alert
1 This is my first payload I will give alert two as my second payload here and let's try this.
So we use this sign and name is infected.
Avoid the excesses but it is filtering this script tag and any variation of script and message is not
infected with accesses at all.
So here we can write in our report that the name is infected with accesses where it does not filtering
all the estimated element.
Now this is how your test stored accesses I'll keep the series going till then.
Have a great day.