Another interesting feature
that we should test is the booking.
So let's click on "Book Now",
and we already saw how this works,
but we're just gonna do a quick recap.
I'm gonna put my name as, "Test."
My email as "test@test.com."
I'm gonna pick some random date,
so this allows us to book a table.
We're gonna click on, "Reserve."
You're gonna get a message saying,
"You're gonna get an email."
If it's accepted, we're gonna say, "Thank you very much."
That's great.
And then we're gonna be redirected to this page.
So, we're being redirected to "confirmed.PHP."
We're not at "booking.PHP" anymore.
And again, you can see the information
that we typed being populated in these input boxes.
And you can see that it's just saying,
"Our booking is pending confirmation."
And we can see the booking or the order ID.
So this is a lot of information
that can give us a lot of clues.
So this tells me that something was submitted on a database
and that's the order ID of it.
All of these input boxes are being populated by values
that we sent originally in the original form.
So, if we, for example, right click this,
and inspect the element,
you will see we have an input box in here,
and its value is being set to "test."
So whatever we're putting in here,
is being reflected in the page somewhere.
It is inside an input box inside the value.
But, as we learned previously,
if we managed to break out of this constraint,
we're gonna be able to inject HTML
and JavaScript code in this page.
So same goes for the email address,
and also same goes for the date.
So, even though the date is not a normal input box,
where you can type anything in it.
The date, as you can see, if I click it,
I can't type anything.
And I can only use it if I click in here,
and select an actual date.
So it might seem like you can't really inject code in here,
but, in reality, once we intercept this with Burp,
we're gonna be able to do anything we want.
Because again, if we right click and inspect this element,
you can see its normal input box and its value
is being set to whatever value that is being set in here.
So, if we intercept the original request,
and change its value in Burp to whatever we want,
we're gonna be able to inject normal text in here.
And hopefully, we'll be able to inject some JavaScript.
So, let's go back, close this,
and let's go back to the original booking page.
So we're clicking on, "Book Now."
We're gonna turn on our interceptor,
and we're gonna put any values,
actually really doesn't matter this time,
because we're gonna be modifying it in Burp.
We're gonna click on, "Reserve."
And as you can see, we have the post request being sent
to this end point.
You can see there is a parameter in here
with a value saying, "No."
So again, you should test this for a lot of vulnerabilities
and this is actually vulnerable to something.
You can test it in your own time, but, in my opinion,
this is not a very common vulnerability.
So I'm not gonna waste time showing you what it is.
But, what's interesting is what we have in here,
in the bottom,
which is the values that we set for the email,
for the date, and for the username.
So, as we saw earlier,
all of these values are being injected
inside the value parameter for an input box.
And therefore, to test for JavaScript injection,
we're gonna, first of all, close the value with a quote,
and close the input box with this sign,
and then add our script,
and we're gonna do alert two,
and we're gonna finish the script.
Now, ideally, you'd wanna test one parameter at a time,
to see how the website is behaving.
But I'm actually just gonna send it to the three parameters.
And I do this every now and then,
when I'm testing really quickly.
And then I would zoom in and test every single parameter
on its own.
And as we saw earlier, once you get some clues,
you can go ahead and use the intruder with the payloads
from the cheat sheet and build it up one element at a time,
or one word at a time, if you really wanna say that,
until you discover the vulnerability.
But for now, we're gonna keep it simple.
We're gonna do it this way.
We're gonna click on "Forward."
Gonna click on, "Okay."
And we're gonna stop intercepting it,
because we don't wanna do that.
And perfect, as you can see,
we are getting our code to be executed.
So we have our JavaScript code injected in the page
and therefore we have discovered,
a reflected XSS vulnerability.
Now, if I click on, "Okay,"
as you can see now,
I can see the JavaScript in here
is actually being placed within the input box.
So that means this input is not vulnerable
because the web application knows that this is just part
of the input, it is not code.
Same goes for this one. It's being placed within the input.
It knows that this is not code, it's part of the input.
But in the date, we actually don't see anything in here.
The script that we pasted is not actually being displayed
in here.
And if we right click and inspect the element,
you will see we have the date that was selected.
And then because we closed the value,
and we opened up our own script,
you can see our own script is being treated
as code, as part of the page,
and therefore it's being executed on the page.
So there you go.
The date parameter, even though it seems like
you can't put any code or any text in it,
once intercepted in Burp,
we're able to put anything and inject anything within it.
And as you can see,
the programmer probably filtered these inputs thinking
that they can be manipulated,
and thinking that this one cannot be manipulated.
But as you can see, we managed to inject code
in it by simply intercepting the data in Burp.