So the reason why I always test for html injections
before Xs s because excess s is more dangerous.
Html injections are less dangerous.
But like I said,
if you discovered that it is counted as a bug
and usually if I managed to discover a html injection,
in most cases I'm able to convert it into an X.
S. S. And therefore I would have to vulnerabilities discovered instead of one.
So it's a very good indication of the existence of an X. S. S.
And like I said,
the hint that we got that there is an excess S is the fact that whatever I type in here,
we will see it on screen.
This means that as a user I can manipulate whatever I put in here,
I'm going to see it on screen and hopefully I'll be able to inject
some either html or javascript and get it to be executed by the browser.
So let's try to inject some javascript and we're going to go with a very,
very simple javascript payload.
So we're just gonna script
alert is the javascript code that we want to run and it
basically just displays an alert message and we're closing it in here.
Now obviously this alert message is not very dangerous if it gets executed.
So let me show you,
we're gonna search as you can see we get an alert message saying too.
So we managed to get our javascript to be executed on the target.
So we discovered a reflected X.
Ss vulnerability, why it's reflected because as you can see in here,
the only way for us to get the alert code to be executed on
the browser is if we copy this link and send it to our target.
So as you can see this link actually contains the javascript payload
that we got to execute and you're gonna have to copy this,
send it to your target and if they load it,
assuming this is the target again they will get the code executed.
That's why it's reflected because you have to give them
a link with the javascript payload or the XS.
S payload.
If we inspect this element, Now let's just inspect it again,
just to show you that our javascript got injected within the
html code off the page as you can see in here.
So we have our script alert too.
Now this code is not dangerous at all,
it simply just shows a warning message and alert.
But the fact that we managed to execute this
simple piece of javascript code means that we can
execute other more dangerous codes and I do cover
all of that in my website hacking course,
but it's not really relevant when it comes to bug bounties because what
you have in here is enough to prove that the target is vulnerable.
So when your pen testing or when you are doing bug bounty, once you get this,
that's it, you should submit your bug and pen testing.
Sometimes you might want to escalate this and see what you get out of it.
But the fact that you managed to execute any type of
javascript code means that you managed to discover an X.
S. S.
And therefore you should be rewarded or in a
pen test then that's a really good finding.
So we're gonna move on to the next one and the next
one is going to be an example of a stored exercise vulnerability.
Again we have another blog.
Like I said browser do whatever, see what happens but one save time.
So we're gonna view a post again notice here you have post I. D. Eight.
So you could you should test that for whatever vulnerabilities that we
learned about so far and what we want to test here.
Again we have a comment and remember when we were looking at the previous lab I said
we should test the post and see what can we what can we discover in here.
What can we inject, what can we do with it.
So again let's put a normal test name is just name, email is whatever
and website google post, see if it were expected the blog
and I have my post in here just normal. Now let's do one with a normal html injection.
So we're going to do it with the B. Tag and let's say test
and we should expect that to be to be involved.
And let's put the name whatever test put an email and a website and posted.
Um going back
looking at it and you can see now the test is involved.
So that means that we discovered the html injection already.
And let's go ahead and use a normal X. Ss payload.
So I'm actually just gonna copy pasted here.
Similar to what we did script alert to script,
put a normal name, normal email, normal website posted. Now, watch this.
If we go back to the blog without doing anything without clicking on any links.
As you can see the code that we injected is getting automatically loaded on the page.
That's why it is a stored excess s vulnerability because whatever
we injected in this comment has been stored in the database
and now anybody that loads this post on this page will
always see the result of the execution of this code.
So now you won't need to share this U. R. L. With the target.
You can simply just wait for the target to actually load this page to
actually come to this blog post and when they do come to it,
your code will be executed.
Whereas with the reflected one you actually have to give them a specific U. R. L.
With the code embedded in the U. R. L.
This is very realistic here,
if there is no security but the next ones will be even more realistic.
And websites that actually have put
some time into implementing some security rules