And this lecture and the next few lectures we're going to talk about a vulnerability called excess.
Excess is short for cross-site scripting.
This type of vulnerability allows an attacker to inject JavaScript into a page.
So JavaScript is a programming language and using this vulnerability, an attacker would be able to
execute code written in JavaScript into a certain page, into a website.
JavaScript is a client sign language.
So when the code is executed, it will be executed on the client, on the user, on the person who is
browsing the web page.
It's not going to be executed on the server.
So even if your code results into giving you a reverse shell, the shell will be coming from the user
who is browsing the page and it's not going to be coming from the website.
So any code you write in JavaScript will be exploited or will run on the target user, on the people
who see the pages, and it's not on the web server.
So the web server is only going to be used as means of executing the code or delivering the code.
There are three main types of access vulnerabilities persistent or stored, reflected and done based.
This third access gets stored into the database.
So the code that you inject will be stored into the database or into the page so that every time any
person views that page, your code will be executed.
And the reflected one.
The code will only be executed when the target user runs a specific URL crafted or written by you,
so you'll be manipulating some sort of URL and send it to a target.
And when they run that target, when they run that URL, the code will be executed.
The Dome based results from JavaScript code written on the client.
So the code will actually be interpreted and run on the client side without having any communication
with the web server.
This could be very dangerous because sometimes web servers apply some sort of security and filtration
to check for XSS.
But with domain based, the code never gets sent to the web server, so the code will be interpreted
and run on the web browser without even interacting with the web server.
And these will be present into websites that update their content without refresh.
So we've all used websites where you put your username, for example, and it loads them straight away
without having to check with the web server.
Or you do you put some sort of a string and it does a search without communicating with the web server
or does something without communicating with the web server.
So if you are able to inject into that, then this injection will not be validated.
So it will be executed straightaway and bypass all validations.