In the last lecture,
we discovered that the homepage takes a parameter
that is called 'from',
and we discovered that that parameter is vulnerable
to an open redirect and to an access vulnerability.
We can also see the next line in the code is identical
to the previous line and it also uses the same method
that we spoke about,
which is the 'get' method for the URL 'Params',
but the value this time is 'type'.
So, similar to the way that we concluded
that this page takes a parameter that is called 'from',
based on the value that we have in here,
we can also conclude the same,
that this page also takes a parameter that is called 'type'.
Now, because the name in here is not very meaningful,
we can just continue reading the code and see
if it can give us any hints.
Again, I'm assuming you know nothing about JavaScript
and I'm actually not a JavaScript developer myself.
I just know a bit to get by.
We're just gonna read it step-by-step
and see what we understand.
So, we can see that there is an 'if' statement
and it's saying if the 'redirectUrl',
so that is what we set in the 'from',
if it is set to 'null',
then this code is gonna be executed, which is nothing.
'Else', so that's our code.
This is what we are executing because we are setting
the 'from' to a value.
So, in that case,
it's gonna check if the redirect type is one,
and the redirect type is defined in here,
So its value is taken from the type parameter
that we can set in here.
So we know now, if we set its value to one,
then this piece of code is gonna be executed.
So, before we understand what this piece of code does,
let's just go ahead and we are already using the 'from'
and we're already putting something in the 'from',
so let's just do 'test',
but we're gonna add an ampersand and we're gonna set
the type and we're gonna set it to one because we know,
from here, if we set it to one,
this piece of code will be executed.
Now, we don't know what this piece of code does
and therefore, we're gonna simply copy this code,
window.location.href, and simply go to Google
and look it up.
And again, the first result is actually really good.
You don't even need to click it to understand what it does.
It's telling you the window.location.href returns the URL
of the current page.
So, right here, this statement is trying to set the location
of the current page.
So this is really good because if we can manipulate this,
we might be able to change the location of the current page
and therefore, get an open redirect.
So right here, we're saying the location of the current page
is equal to the 'getHashValue' of whatever value
that we have in here.
And again, assuming we don't know what this is,
we're gonna copy it and we're gonna paste it in Google.
And, as you can see, we're not getting any good results,
so I'm simply gonna say JavaScript and, as you can see,
again, the first result seems to be useful and it seems like
this is a common way of getting the value
that comes after the hash sign.
So, based on this,
I can make the educated guess that I can use this
as a parameter, but instead of an ampersand,
I'm gonna have to put a hash before it,
followed by this value,
followed by the value that I want to send.
So let me show you what I mean.
We are setting the 'from' to something,
we're setting the 'type' to one,
and we usually use the ampersand
to add two parameters together,
but this right here is not a parameter because,
as we saw earlier,
this is the way to extract parameters from the request,
but right here, this is not a way of extracting parameters.
This gets you whatever value
that is inputted after the hash.
So we're gonna put a hash and then we're gonna put the value
that we have in here, which is 'redir',
and we're gonna make that equal to a website
because we already looked up what this does and we saw
that this gets the location of the current page.
So hopefully, whatever website I'm gonna put
after the 'redir', after here,
is actually gonna be set to this value right here
and therefore, the user will be redirected to that page.
So let's go ahead and test that theory.
We're gonna set it to https, google.com.
Gonna copy everything just to make sure,
just so that I can modify it easier
in the future if I'm wrong.
I'm gonna hit 'enter', and perfect.
As you can see, I actually got redirected to Google,
which means that we discovered
an open redirect vulnerability in this page.
And also, as we learned before,
the fact that we see a 'href' in here gives us a good hint
that this value that is coming in here is being executed
as a 'href' link and we know
in the 'href' we can actually execute JavaScript
by simply type in JavaScript,
followed by the code that we want to execute and,
in our case, it's 'alert', let's say four.
Hit enter.
And perfect.
As you can see, our code is getting executed on the page,
which means that we discovered
a Reflected XSS vulnerability.
So now, we have two vulnerabilities discovered in this page
and both of these vulnerabilities are within elements
that we would never see in normal usage of the page
and we were only able to see them
by viewing hidden elements using this extension right here
and then analyzing the JavaScript code.
And also, a very important take on lesson from this
is that you should not worry about the code
even if you don't know that programming language.
You can always just follow it step-by-step
and look up whatever functions or methods
that you do not understand and learn that way.
This is a very important trait
that really good bug hunters have.
A lot of the time they approach systems and code bases
and applications and frameworks that they do not understand.
So they might discover a hint that there is a bug
and then they discover that they don't really know
how this system works or how this framework works
and they actually go ahead and learn about the framework
and read the documentation and see
if that can help them understand the target application
and then they go ahead and apply what they learned in order
to discover their bugs and vulnerabilities.
That's why a lot of bug hunters are referred to
as researchers because there is a lot of research involved
when it comes to bug hunting.