All the JavaScript injections that we've done so far.
We used to inject them like this, so we used to actually inject them in the HTML code and we used to
have to put the script, alert, access script, or put anything in here, depending on the cheatsheet
that I shared with you.
Now, I've said earlier with SQL injections, the payload or the exploit can vary from website to website
depending on the way the website is programmed or the page is programmed and XSS is the same.
So you always you need to approach the websites and think about it in a general idea and try to exploit
it depending on the page itself, and don't always just copy and paste the exploits or the payloads.
And to do that, I'm just going to show you another example today.
And we're going to do it in a day and we're going to go to the injection and I'm going to go to the
JavaScript injection and to the password generator.
Now, what this page does, basically you click on the generate and it just generates a random password.
So there are a lot of websites on the Internet that just do that for you.
Looking at this at the website, it's telling us that this password is for Anonymous.
And looking at the URL, we can see that it's given a username and the username is given in the URL
in the username parameter and it's given as anonymous.
So we can just change that name to any name we want.
So, for example, if we change that to Z.
It's telling us that this password is being generated for Z and if we generate it's going to be generated.
Now note that whatever you write in here is being displayed here, and this should instantly tell you
that maybe this could be vulnerable to an excessive vulnerability because whatever you're typing is
being displayed.
So let's try and use the same exploit that we always use and try to get it injected in the code and
the page.
Now, as you can see, the exploit didn't run, so we didn't actually get a pop up box telling us that
there is an XSS in the page, but something went wrong.
As you can see now, some of the code is being thrown at the page.
This shouldn't be shown in here.
You seen in the basic case, when you just put a normal name, you don't actually see this code.
So that means something is happening.
Something's going wrong in this page.
So let's try to inspect the element.
And I'm just going to make this bigger.
Now what I want to focus on is the part of the code that's been thrown in here on the screen.
So I'm going to right click it and again inspect the element just so that we get navigated automatically
to where that is in the code.
And I'm going to go down.
And you can see that this part of the code is being broken.
We usually add the script tags ourselves when we when we try to inject like you like you see in here.
But what's happening in this page, it's automatically trying to put what we input our user input inside
to script tags, this one and this one.
So first of all, we know that we don't need these.
Because they're already there.
Also note that our code is being injected here.
So this is my code script alert access.
This is what I entered for the username and you can see that this is being placed inside a single quotation.
So in order to exit this quotation mark, I'm going to add one in my exploit.
Okay.
So that's going to close this for me.
And then I remove the script.
So it's going to become alert access, which looks really good.
And then we have the end of the script here.
So let's have a look again on the code.
So you have the first line.
It's saying document dot, dot, get element y ID.
Now I actually don't know how to program in JavaScript, so you don't need to be a JavaScript programmer,
but you just need to have like a general idea on how this is going to work.
So we can see that this is the first line of the code and it's saying this in HTML is equal to this
password is and whatever we input between the two quotes.
So what we did, we closed this and then the next line is going to become our alert access.
So in JavaScript to end one line, you actually have to add a semicolon.
So we're going to close and add the semicolon in here and our exploit.
And what this will does, it will close the quote here and it'll execute this as another line, as the
next line.
And I'll add the semicolon here at the end, just in case.
And I'm going to copy this.
I'm going to inject it, and I'll show you what the code looks like.
After we inject it, it will become even clearer.
So I'm going to inject it here.
Now, as you can see, there is nothing but if we click on the generate.
Now it looks like there's something still wrong, so we still didn't really inject it properly.
Let's have a look on the code again.
So again, right click inspect element.
And we're going to go down to where the codes for the user right here.
And this is what our code looks like now.
So it's saying try document or get element y ID and this is telling this is equal to this password is
for we close that.
So that's really good.
We added a semicolon.
Perfect.
And then we set alert access.
Very good semicolon perfect.
But then we have this single quote and this semicolon and these are coming from the original code.
So these are used to close this statement originally.
So they're actually being hardcoded or inserted by the code in the web page.
So all we have to do is do like what we used to do with the SQL injections and just add a comment here
to comment everything that comes after this so that it doesn't break our code.
So, again, I'm going to copy this.
Paste it in here.
And as you can see now, our code runs and we manage to run JavaScript code on the Target website.
Now you can share this link with any JavaScript code you want and that will be executed on the target
person, on the person that runs this link.
So you can go ahead and look up any types of codes for JavaScript or you can use beef like I'm going
to show you in the next lectures.
So the take home message from this lecture is the way you exploit vulnerabilities not only Java, not
only access or SQL injections.
Any vulnerability is going to vary from website to website.
So you have to always think about it.
Maybe you look at the source code, look at how the data is being transmitted between the websites,
and try to adapt your exploit to that specific web page.