Now let's come back to the homepage
and start actually testing the features that we used before.
As we know, all of these links
will actually make us leave this page
and take us to other pages, which we will test eventually,
but for now, I wanna stick to this page
and we're gonna try to login our register in here.
As we did before, let's try to log in
with a wrong username and password.
And if we click on login, you will notice
that we actually have a parameter called act in here.
Now, in other cases, you might not see
this parameter in here, but the fact that we are logging in
means that information is being exchanged
and sent to the web server,
and, therefore, if you don't see that in here,
you should intercept the connection with Burp
and then analyze what's happening.
Analyze the data that is being sent and modified.
Well, in our case, we already see this.
We already see act is equal to log in.
So we already have a value in here, which is login,
that we can test for all of the vulnerabilities
that we learned before.
And before I do that, I'm actually just gonna put something
very distinctive so I can find it and see
if this value, that is being typed in here,
if it's being reflected on the page somewhere.
So we're typing in login, and let me just type testtest.
And I'm gonna copy this term
because I'm gonna need to search for it,
and I'm gonna hit enter.
So, as you can see, the page loads normally.
There's nothing weird in the page at all,
but, as we know, this might be injected
somewhere in the page that is not visible in here.
We're gonna have to look at the page source to see it.
So you could either right-click and View Page Source
or you could Inspect any element,
and that will reveal the page source.
And from here, you can do Control + F
and then paste whatever you're looking for.
Now this will only search within the code,
but you can see, even at the start before the code
of the page starts, before even the HTML tag,
you actually have a comment in here.
And in the comment you have whatever we injected,
the logintesttest, is being inserted
in this part of the page.
So a better way of finding this would be to right-click
and View Page Source.
And if you do Control + F and paste it,
you will find it in here at the very top of the page.
Now, previously, we learned we can use
double forward slashes as a comment for JavaScript.
We also learned that we can use a hash,
and double forward slashes, and others,
for SQL when we're doing SQL injections.
And in HTML, you can also add comments
using this syntax right here.
So this would identify the start of a comment,
and this will identify the end of the comment.
And everything that you see within it
is actually a HTML comment
and, therefore, whatever you type in here,
will never be considered as part of the page.
So similar to everything that we learned before
when discovering bugs, we wanna break out
of the constraint that we are in.
And currently, the constraint is the fact
that whatever we're typing is being placed inside a comment.
So if we wanted to break out of this comment
and have this text being considered as part of the page,
we're just gonna proceed it with these characters
so that it is outside of the comment
and that the comment ends in here.
So I'm literally just gonna copy this,
and we're gonna paste them right before
the value that I am injecting.
I'm gonna hit enter and perfect.
As you can see now, I have my logintesttest
is actually being considered as part of the page.
So now that we are able to break outside of the comment
and our text being placed inside the body of the page,
let's try and see if we have the HTML injection.
So to do that, as we did before,
we're gonna be put in a HTML tag before and after our text.
So I'm just using the tag in here.
And then if I hit enter, as you can see,
the text is bold now.
So instead of being a normal text, now it's bold,
and we don't see the HTML tags that I inserted.
And, again, if I just right-click and Inspect this element,
you can see right now it's actually being placed
inside the tags that I added myself.
And, therefore, because I am able to inject HTML code
in here, that means I have discovered a HTML injection,
and in most bug bounty programs,
you will be awarded a bounty for this.
So now that we discovered the HTML injection,
as mentioned earlier, we always try to see
if we can escalate this to an XSS.
And to do that, we're simply gonna replace
this with a script, and we're gonna type
our alert code in here, so let's say alert2.
And then finally, we're gonna close it with another script.
And I'm actually gonna remove this last tag from here
because, as you can see, the web application
is automatically appending the closing tag in here.
And, as we mentioned earlier,
it is always best to do the least amount of changes
and let the web application close tags for you,
or close the comment, or just let it complete your exploit.
So that's why I'm leaving the script tag open.
You can obviously test with both,
but that's why I'm doing it this way.
So we're gonna send it as is.
And, as you can see, we have our alert being injected
in here, but if we inspect the element,
you will see that we have the alert on its own,
and the script tags that we added are being stripped.
So that tells me that this website is using
some kind of a filtering that is stopping script tags
from being injected in the HTML.
But that's not enough to make me give up
because, as we saw earlier in the XSS section,
there is so many ways to bypass filters,
and we even covered how to use the Intruder
to automatically go through a large list
of tags, and parameters, and then exploits.
We covered all of that step-by-step.
So if you don't remember how to do it,
please go back and revise that lecture.
But what I'm gonna try, if you wanna keep this manual,
if I'm actually playing with this,
I actually would try a few manual things before I go to Burp
because that will send a lot of requests,
and cause a lot of logs, and, in many cases,
I'd be able to get it manually.
So a very common or fun tag that we can try is the image tag
because that doesn't require closing.
And within the image tag, we can actually do the source,
so the src to something that does not exist.
So, for example, x, and then say onerror,
so whenever you get an error,
I want you to execute some JavaScript code.
And, in this case, I want you to do an alert
and show me number two.
So very, very simple.
We're injecting an image tag,
we're giving it the source of the image
to something that is wrong, that doesn't exist,
and we're saying when that happens onerror,
I want you to execute this JavaScript code.
Let's hit enter and see if this works.
And, as you can see, it is injecting the image,
and the image is not loading because, you know,
the source that I gave it is wrong, which is x,
but for some reason, it's filtering or removing
the onerror event that we have in here
because we don't see it in here.
So, again, we covered how to do that with Burp
before using a cheat sheet.
How we could build it one step at a time.
So inject the image first, inject the source second,
and then inject different events
until you see the one that passes it.
But if we're playing with this manually,
just quickly, just to get a feel of it,
we can see that the onerror is being filtered,
but we can also see that the web application
is appending this to our image, to our payload.
So I actually don't need to close this tag,
and hopefully if I don't do this, the filter will fail.
So let's do it and perfect.
As you can see, we managed to get the target web application
to execute the JavaScript that we specified in here.
And this is why manual testing
is actually superior to automation.
So use an Intruder and all that is actually really good
because it's actually a hybrid
between manual testing and automation.
So once you start playing with the code enough,
you can actually have your Intruder submitting the exploits
without the closing tag because you know that your target
does not need the closing tag.