in this lecture,
I want to show you an example where the
user input is used directly within javascript code.
Just to highlight the importance of analyzing and
understanding where the user input is being used
because in this case, as you'll see soon,
we're going to be running the javascript code as
is without having to enclose it in any tags.
Again, as usual, you want to test everything in here.
I'm just gonna go straight to the to the
search because I know this is what's vulnerable.
We're gonna search
and as usual,
you wanna exploit this as much as possible from what you're seeing here.
So within the text box, if you try everything that we covered, so far,
none of it is going to work because this page
does actually implement some protection
against against excess s vulnerabilities.
Therefore,
when you exhaust all the possible tests that you can do within this text box and you
can see that it's filtering everything and it's encoding
everything and there's no way to exploit it.
We're going to start looking for other places where
we might see the string that we typed,
where we can see the input that we typed being reflected inside the code.
So again, control F and we're going to look for whatever we typed. So we typed test
and we can see the first instance of it in here,
but we can see that there are three instances in this example,
so you can actually just see one of them in here and that's within the image tag.
And we covered this an example very similar to this in the previous class as well,
but again,
I've already tested this and if you tried the method
that we did in the previous class with this one,
it's not gonna work, it's actually filtering it and protecting it properly.
So again, I don't want to waste your time.
But in a real life scenario you would want to test this as well.
So we're going to look for the other instance and this time you can see
the other instance is actually inside a javascript code or inside a script tag.
So we have the start of the tag at the end of the tag.
This is the javascript code and we can see the instance
of the input that we typed being reflected in here.
So if you read this, even if you don't know javascript,
it's pretty self explanatory.
So we have vier which is probably a word to define a variable.
We have a variable name called search terms and it's
equal to the input that we typed in here.
Test.
And we can see this time it's enclosed between two single quotes.
So you can go ahead and look up what the single quotes mean in javascript.
But usually in most programming languages as single quotes are used to define
a string and you can't really inject any variables inside that string.
So whatever we're typing in the input is already being used inside javascript code,
the only problem is it's being enclosed between two quotes
and therefore whatever we type in here is not actually
going to be executed as code because the browser is
actually going to know that this is a strength,
it's just a an array or a list of characters.
It should not be evaluated as code.
So all we have to do right now is break out
of these two single quotes and once we do that,
whatever we type is going to be evaluated as javascript
code and therefore it should get executed on the page.
So all we're gonna have to do is close the quotes.
The single quote that is already being opened by the application.
It's already opening two quotes as we said before.
The first thing we want to do is complete whatever code that we already have,
whether it's html code or javascript code.
So we're going to complete it by closing the quote.
Then we're gonna need to add a semicolon to complete the sentence because our
complete this line because in javascript every line should end with a semicolon.
So we can see this line ends with a semicolon.
We can see this line ends with a semicolon.
Therefore,
to complete this line we close the quote and then we're gonna add a
semicolon to basically end this line and then we're gonna start a new line
And then in the new line we're gonna add our payload
and in this example we're simply gonna do alert 22.
Once we're done with the alert we finished our statement.
So we're gonna close it with a semicolon as well like I said.
And the only problem now if you can see our input is
being put between the two quotes and then we have the semicolon.
So the program is automatically adding a single
quote and a semicolon after our input.
So now our input is going to be like this, we're closing the quote,
we're closing the semicolon,
we're adding our command or payload and then we're
ending the statement as well with a semicolon.
But then the program is going to automatically add a single quote and a semicolon
which will probably break the code because we're
gonna end up with something like this,
which is basically not good.
It'll probably break it.
Therefore what we're gonna do is we're gonna add two forward slashes
to set everything that comes after the two forward slashes as a comment
basically,
comments tell whatever program that is executing the code that everything that
comes after the comment sign is not part of the code,
so you should neglect it.
Therefore when when the program automatically adds the
single quote and the semicolon in here.
The program or the browser is going to know
that these two characters are part of the comments.
So they're not part of the code and the code is going to end like this.
This is well defined because we have a function.
And at the end of it is a semi colon,
which is exactly what we need to have in javascript.
Therefore it should all work.
So I'm just going to remove this because it was just
showing you how this would work and we're going to copy this
and we're going to paste it in here. We're gonna search
and perfect.
As you can see our code got executed the alert code get executed,
which means that we managed to inject javascript within this page,
which means that we managed to discover a reflected X ss vulnerability.
So the usage of the comments is not the first example that you
probably have seen because we do this with SQL injections as well.
A lot of the time we have to comment everything that comes after our payload or
after our exploit so that we tell the server side languages in that case or whatever,
interpreter interpreting our code,
that everything that comes after the comments is not part of the code.
And therefore our injection should be well defined and gets executed on the system.