Okay.
Now let's have a look on asteroid X example.
Now start X is very similar to a reflected one.
It allows you to inject JavaScript code into the browser.
The code is executed on the people that visit the page.
The only difference is with with the reflected.
You have to send the URL to your target.
So the target had to actually click on a URL for the exploit to run or for the code to run.
And the stored excess, the code will actually be stored into the database or into the page.
So every time any person runs that page, they will see your code and your code will be executed.
So you won't need to interact with any users or send them anything.
Therefore, this could be much more dangerous than reflected excess.
So let's have a look on this now.
I clicked on the X stored here on the left and you have this page and this page just allows you to add
a message to the system.
So I'm going to put my name aside.
We're just going to do a normal test first and we're going to put a message body, for example, and
then I'm going to sign the guest book.
And you can see that they added a message called Message Body.
So if we go to here.
Into another machine.
So this is a different machine to a different place.
And if we go to the store, we can see that there is two entries.
So the entries are being loaded from the database and they contain the entries and that database.
So if we manage to inject code in here, then any person who runs this page, the code will run on it
without even having to send that person anything.
So let's try to inject stuff here.
So let's put my name a.
And I'm going to try to put my code in here.
So I'm going to try to inject into the message.
I'm going to put it as script.
I'm going to use the exact same test code that we used in the previous video, just a message saying
access, again, very basic code.
But it serves for the purposes of this video.
And we're going to say alert.
Access.
And I'm going to try to sign the guest book.
And as we can see now, I got the exercise here.
But the real magic happens when a normal person.
So let's just go home first and let's assume this is just a normal website and people just are coming
and browsing it.
And once they're going to go to the guest book, JavaScript code will be executed on their system from
that website.
So the code is coming from that website and it's going to be executed on every person that visits this
page.
Again, we're just showing a proof of concept here.
And future videos will show how to further exploit this kind of vulnerability.