now before trying an ex.
Ss I usually try to see if I can inject normal html code because
html injection is still considered as a vulnerability in many bug bounty programs.
And if you're doing a pen test then you should certainly include it as a discovery.
So a html injection is actually just pretty much very similar to X. S. S.
It just means that we can inject html code instead of javascript code.
Usually if I managed to discover a html injection,
in most cases I'm able to convert it into an X.
S. S. And therefore I would have to vulnerabilities discovered instead of one.
So let's start with a simple example
and then we're gonna move on to more complex ones.
As you can see, Target is a normal website looks like a blog.
And as usual, if you're targeting this website for the first time,
whether it's a bug bounty or if it is a normal pen test,
you just want to first of all visit the website itself, see what it is.
It's a blog.
Pretty cool load the blog post, for example, view post, look at it, see what we can do.
Okay. We can add a comment. Maybe just even add a normal comment and see what happens.
See if you can exploit these comments, go back, all that kind of stuff.
Not really going to do it now because we covered it before.
Just want to talk about it and then you see a search functionality. Cool.
Let's try to search for something. So let's search for test,
See if it works actually works. We've got zero results for tests.
That's actually search for something that is in the website.
So digital, there's this word digital here. So I'm just gonna tap digital
just to see if the functionality works. It works. Cool. We got one result.
See as I mentioned earlier, javascript is interpreted or executed by the browser.
So if you have an input, whether it's an input like this in like a post box,
like this one in here or if it is in here in the RL if you have a value here in the U.
R. L. That is being displayed on the current page,
that means that we as a user can actually inject normal text.
We're not saying it's a vulnerability, it just means that whatever I type,
whether it's in this box or in the U.
R. L. I can actually see it on the web page.
So that itself should be a really good hint for
you that we might have an excess s vulnerability if the
programmers were not careful because I can type things using my
keyboard whether in the text box or in the U.
R. L. And I will see it on screen. So I know it's something very simple.
Like I'm saying it's you're simply just typing something
and you see it on the web page.
But the implications of this can be very very
dangerous if it's not handled properly because we as users
can manipulate this input and maybe inject some code in it.
So let's try this very very simply before trying an ex ss I usually try to see if I
can inject normal html code because html injection is still
considered as a vulnerability in many bug bounty programs.
And if you're doing a pen test then you should certainly include it as a discovery.
So a html injection is actually just pretty much very similar to X. S. S.
It just means that we can inject html code instead of javascript code.
So it's a step below.
It's not as dangerous but it means that we
can still manipulate the page in some shape.
So to inject html, you can just try any html element. And just to keep this simple.
So I'm just gonna do digital again. So that's what we search for.
And this time there is a tag in html that is called the B tag.
And this tag basically makes whatever text that you put inside this tag,
it makes it bold.
So if you type B digital slash B whatever that is insight which is the B should be bold.
So notice how the B is normal now.
And if I search now as you can see the B is bold.
So if I inspect the sediment to see
the html code responsible for rendering this page,
you will see that we have the html code that I injected the B.
And the slash be injected in the page.
And we obviously don't see it here in the
result because the browser is interpreting this part,
the browser knows that this b is actually not part of the text.
This is a html element and therefore I'm gonna render it accepted and executed.
And when it does that it makes whatever that is inside it as bold.
So that means now we can inject any html element.
If you know html,
you can start playing with this or you can just go use
google and see what kind of html elements we can inject.
So you can do for example, instead of injecting the B, we can do a hey, Trev equals
Z security dot org
and we'll say click here
and let's do slash a
and search
and now we have a link injected in the page.
Now this is pretty bad because this page is not supposed
to have this link and if we click on this link,
I'll just open in a new tab, it'll actually take me where I want to go.
So you could actually have a fake page in here,
a fake log in page or a page that contains malicious downloads or whatever.
So this on its own is a vulnerability in bug bounty programs.
And if you're doing a pen test, you've already done pretty well