so the main thing that we learned so
far is unless you can inject javascript within the
element that you have access to close that element
completed and then inject after it with that.
Let's move on to the next example.
In this example we have a star website and it's
actually similar to a website that we covered before.
As usual.
You want to use it test it whatever use every single functionality and test it.
Now we're going to go to the one that I
already know is vulnerable to not waste your time.
And it's this one the star checker.
So again you want to use it as normal for example let's set the store to paris check
stock and it will tell you how many units are available of this product in that store.
So as you can see everything looks fine and we don't
even have anything to inject as a variable in here.
Therefore in this case you're gonna need to
proxy this through burp to see what happens
because as you know if we can see it in here we can play with it.
But if we don't see it then we're gonna have to send
it through a proxy and modify the values through a proxy.
So I'm gonna turn my interceptor on and let's go to Milan this time.
And when we do that you can see we actually have two values being sent
we have the product I. D.
And the star I. D.
As usual everything that the user can manipulate.
We tested for all vulnerabilities not just for X. S. S.
So you should test it for SQL injections and so on.
Now. Again to save you time. I'm not going to be testing product I. D.
I'm going to be testing Star I. D. Because I know Star I. D.
Is vulnerable to an excess S but in a real life scenario you want to test both of them.
So I'm going to copy the product I. D. Parameter,
turn off the interceptor first
and paste it in my U. R. L. Bar.
And I'm going to modify its value to Milan A
to see if the website will actually display this modified value on the page.
If it does then we know the manipulated user input is being used within the page.
And therefore we're going to try to inject html code to
get an html injection or javascript code to get an X.
S. S.
So as you can see I always make small,
simple modifications and build up my payload or exploit.
Step by step
This way if I fell at any stage I know exactly where I failed
and I know what to focus on
to achieve my goal.
Okay that's gonna load.
Now if you scroll down you'll see whatever we typed in the product I. D. Or the store I.
D.
I typed Milan A. We can see it in here.
So that means again whatever you're typing as a user
is being reflected in the page.
Therefore it's there's a good chance that you might be able to inject
and run javascript code within this page
by manipulating whatever your you type after
the store I. D.
So let's inspect this element again
and just see where is our code or where is our text is being injected
and see how we can break out of this and inject our javascript code,
we can see that Milan is being placed as a
element or as an option in here within this input box
because this time the value that the text that we're typing is
being injected in here as is not inside the element definition,
there is nothing to escape.
It's already being injected in here.
So if I go back to my RL bar and I just keep whatever it is,
Milana and I add my script alert.
Whatever 22 script we're going to hit enter
and perfect as you can see it's going to get executed straight away.
Now as you can see
discovering this one is very very similar to what we've been
doing in the previous example this might be actually one of the
simplest and easiest examples but understanding how this works is the
tricky part because sometimes you might think well if you're typing,
you know just this is just the Milano and it's being displayed
in here then there's no way to inject code in here.
But that's the whole point.
Like even though it's been displayed within the options,
you're able to inject javascript in there as long
as it's not part of the element definition,
and if it is part of the element definition,
you should close the element whatever it is, complete, whatever it is,
and then inject your code as we've seen in the previous example.