if you have done any of my other courses,
you know that information gathering is crucial for pen testing and bug hunting.
That's why I usually do it first before I even start pen testing the application
because gathering the right information can increase your attack surface
and help you understand how the target application works.
Let me show you an example of how useful such information can be when discovering X S.
S vulnerabilities.
And as I do,
I'll also teach you how to discover the
technologies used by the target to have application.
As usual. You want to test everything.
So let's test the search with the normal surge.
Let's test it with html injection. And as you can see that's no good.
Now let's do what we did with the first example. So let's copy it
and let's inspect the element and see if it's been injected anywhere else
and we can see that it's only been injected in one place in here.
Now let's try a normal script. Just just to see why not
search
doesn't work either.
So at this stage before giving up I would go back and check the technologies used
by the target website and see if they can point me in the right direction.
As I mentioned,
this should be one of the first things that you do when engaging with a target
to do this. We're going to use a plug in called warp allies.
Er I'm gonna include its link in the resources but I'm not
going to show you how to install it because it's very simple.
All you have to do is load the link and click on install
Once installed you're gonna get this icon right here.
And all you have to do is click it
to get the technologies used on this current website.
Let me just show you an example. So let's go to the security.org.
Give it some time to load. And as you can see we have 31 technologies or libraries
that were loading within this web page.
So you can see that we're using Wordpress, we're using mail chain, my SQL facebook,
woo commerce, all of these for example.
Wordpress and
commerce. They're both web applications. They're open source.
You can actually download them and
discover vulnerabilities within them yourself.
Or you can go and search for existing vulnerabilities in them.
And as you can see we have 31 of these. Not all of them might be vulnerable.
None of them is vulnerable hopefully.
But all of this is very useful information for you when your pen testing.
So going back to our example we can see that this website uses angular Js.
So maybe there is a specific way of injecting
javascript in this website because it's using angular Js.
Now we don't know so similar to the way when I said why are your
text is being injected and then see if you can run javascript in there.
If you don't know use google so similar, this is a similar example.
We don't know if angular if there is a
different way of injecting javascript with an angular Js,
but let's go ahead and see.
So let's just say angular
J S, X. S. S.
How about that? Doesn't get any simpler than this.
Okay,
we have a result here from ports bigger Now this
is the big cheat sheet that I showed previously,
so I don't want to look at that.
Let's look at this one in GIT hub and we have a
weird way to write javascript or excess s payloads in here.
So let's try it. We got nothing to lose. Do we
copy
and let's paste it here.
Now, usually if you're not sure what's happening,
you can always just literally go ahead and look up what the constructor
does in angular Js and you will get a really good explanation.
So it doesn't really stop. You shouldn't just be copy pasting code.
But just as an example here,
you simply can just look for a cheat sheet and then let's run it
and boom, as you can see our javascript code got injected.
So again,
all we had to do in this example is
pay attention to the information that we're gathering.
We can see that a ceramic angular Js,
therefore we tried payload that is specific to angular Js
and therefore we were able to inject our javascript code in here within this element