now, as mentioned earlier, discovering and exploiting dumb ex ss.
Vulnerabilities is identical to reflected and stored.
The only difference between these vulnerabilities is the way they happen,
but at the end of the day,
all of these vulnerabilities allow us to inject javascript code
and the vulnerable web application.
So the examples that I'm going to show you from now onwards
are going to be a mix of dom reflected and stored X.
S. S.
And you're gonna notice that discovering them is exactly the same.
I'm going to be covering several examples because X.
Ss vulnerabilities can exist in different places and therefore
discovering them and exploiting them might be slightly different.
And as I do that,
I'll be covering more concepts and teach you more techniques and more tools.
So the most important indication to the existence of an ex ss
is if the user input is being used somewhere within the page.
Therefore,
by manipulating the user input we might be able
to inject html code which will result in an
html injection or we might be able to inject
javascript code which will result in an X.
S. S.
The location or the context of where the user
input is being used within the page is very,
very important.
And all of the previous examples the user input
was being used outside of any html tags.
What I mean by that is
the user input was actually being displayed
as text on the page.
Therefore we were able to inject our own html tags to get an html injection
and we were able to inject javascript code
inside the script tag and therefore we were able to get an X. S. S.
However
in many cases
the user input might be used within another html tag inside the page.
So it might be used as part of a link
or as part of an image link.
Therefore you won't be able to simply insert
your own html tags or javascript code because the
browser will simply treat the user input as a link and not as html or javascript code.
So let me show you a quick example
we have a normal blog website, test everything with it.
Let's click on,
submit feedback and also test what's in here and
the first thing you should notice is again you should
always look at the RL like I always look at the RL even when I'm doing normal things,
I'm not pen testing or whatever,
you should always look at the RL it should just become
like looking in the mirror when you're driving a car.
So if you look at the RL you'll see you have value or an
argument called return path and the value to it is a forward slash.
Now this is pretty nice in a real life scenario.
Maybe the argument will be called something
else but like this is very informative and
telling you that the return path might be this path that is specified here.
But even the even so assuming that that's not the case, you should always,
whenever you see an equal sign,
you should manipulate the input after it and see
if it's reflected anywhere or if it's causing errors.
If you can discover SQL injections code executions, local file inclusions,
literally everything that we covered
in this example. We're talking about Xs s so we're going to be looking at excesses
and even before you start getting adventurous and injecting anything,
just type some random stuff.
So let's just type Zaid
Z eight.
Okay. Page loads. Normally, no problem.
Let's inspect the element or just open the source code
and let's look for whatever we typed which is a
sad
now interesting enough you can see that this whatever we
typed on top is being reflected in the page.
So again, that on its own should be an alarm that okay,
the user is able to put stuff within the page.
Now the next task is to try to leverage this and use
it to our advantage to either inject html code or javascript code
as mentioned earlier.
We can't inject code here because everything we
type will be enclosed by these two quotation marks
and the browser will consider it as part of the U. R. L.
So we'll have to find a way to inject javascript code within
the current constraint which is within the hatred value right here.
Now if you don't know you're just gonna have to go to google and look up the
tag that you're trapped in or constrained to and
see if you can run javascript within it.
Now I'm not going to waste your time by looking this up using google.
But if you simply look for javascript hatred, you will learn
that you can run javascript within the hatred argument
and all you have to do is simply type javascript
followed by the javascript code that you want to run.
So let's do it. We're gonna type javascript and the code that we want to run is alert
three. Whatever, it doesn't matter
and we're gonna hit enter
and obviously that doesn't run because it will only
run when we click on the element itself.
So again let's just inspect it as you can see whatever we typed in here
got injected so similar to one we type side so saying javascript alert three.
Now let's click it
perfect as you can see our javascript code gets executed