So let's talk about how to discover these kind of vulnerabilities.
Very similar to skill injections.
The way to do this is you browse through your target and try to inject any text box or any your L that
looks similar to this.
So whenever you see your Elouise parameters try to inject these parameters or try to inject into text
boxes
so let's have a look on reflected as exercise example.
So these are the non-persistent nonstory vulnerabilities where you have to actually send the code to
the target.
And once the target runs the code it will be executed on their machine.
So let's have a look on our DVD Web site and I'm just going to log in
and then we're going to have an example of a reflected access as so as you see now you can put your
name here for this text box and it's just going to say hello.
Now this is obviously just an example.
But the idea is you can inject into text boxes.
Also if you have to have a look at the R L here you'll see that it's a GED so you can inject into the
your L as well.
So let me start at the pad
and let's try to inject Exocets code on this and see if the code will be executed or javascript code
sorry.
So what I'm going to use is a very simple script.
So we're using a script and a slide script tag.
Now there is a lot of ways into discovering these kind of vulnerabilities.
And a lot of ways to bypass filters.
But for now we're just having a look at the basic case where we can inject a normal script and I'm going
to say Alert which is just a function to give an alert to give a text box.
And I'm going to say
yes.
So I'm going to click on submit and we'll see if this code will be executed.
And as you can see now it's actually executing my code so instead of saying hello it here it says hello
and my code has been executed and it produced this exercise so we can do the same here if you have a
look under your owl.
It actually already did it for us.
But if we look at the R L here it's just going to be a bit bigger.
They're We can see that the name has been obviously all of these characters are just Hasyim obvious
cave characters.
And now if you send this you r l to anybody who ever views that you or else what the code will be executed
on their machine.
And it's going to say exercice So let me show you here.
You can also inject this in the your eye.
I just want to show you the whole idea of that.
So we have script script access
and if I hit enter the code will be executed.
So as I said we can copy this and send it to a certain person and once they run that code this code
will be executed on their machine.