Now let's have a look on the medium security level and see if we can inject our code and run javascript
code on the target website.
So this is the the exploit that we're using or the payload that we're using.
So I just want to before I change the security level to medium I want to show you what the website looks
like.
So if we just right click in here on the hello and go to inspect element going to make this a little
bit bigger.
So this will actually show us the source code for this specific part of the web page.
So if we look at it you'll see that we have hello which is being written automatically by the program
and the lowest is followed by this trip that we injected.
So it's being injected exactly the same way that we we write it in the text box which is why it's been
executed on the web page so we can see script alert access and then the script tags close which is causing
the script to be executed on the page.
Now let's go ahead and increase the security level
and we're going to set it to medium.
Now we're going to go back to The Exorcist reflected and I'm going to paste the same exploit that we
use and hit submit and you'll see that it's not going to work.
Also notice in the no security level we only see in Halo and everything here was like we didn't see
anything.
Now we see alerts access.
So it's not the pop up is not showing up.
And if we look at the code you'll see that the start of the tag and the end of the tag are not being
injected in here so it's being filtered somehow because all we see here is just hello and then we can
see the alert exercise.
That's why the code is not being executed because it's not placed inside the script tags.
This tells us that they probably are used in some sort of a filter.
Remove the script from here.
Now there's so many ways that you can bypass filters and other type of protection from access.
The best resource is a cheat sheet made by Austin which can be located on the following link.
I'm going to add this link in the resources of this video.
For now I'm actually not going to use anything that's mentioned in the link.
We're just going to do something that's really simple because I think all they're doing is they're just
looking for this world and they're removing it from the input so we can use the exact same exploit right
here.
Instead we're just going to do what we used to do with the skill injection and just capitalize some
of the letters so we're going to have script was going to capitalize it like this and then I'll capsulized
this one as well or probably just that are in here.
And then I'm going to inject this and the page
and as you can see now this works which allow that allow us to bypass the filter used on that Web site.
Now this is a really really simple way of exploiting it.
Now somewhat sites actually check for quotes and enable magic quotes which basically remove the quotes
from the string that you don't want from the text that you don't put and in a future video we'll see
how we bypass that.
That's also included in the cheat sheet.
I'm going to add in the description and the resources.
Also there is a number of nice exploits or payloads that included in the cheat sheet as well.
For example you can inject stuff as an 8.
You can inject stuff as well as an event of a job as a javascript event.
So when the mouse goes over that particular protocol will be executed.
And you can also injected you can give an image and give a wrong source code and get the script to run
when there is an error.
Since you're given a wrong source code or source you are l for the image.
The code will work anyway.
Let's have a look on this one.
So again we're just going to paste it in here.
And as you can see the code will work here and all of this is included in the cheat sheet.
And you can go ahead and there I'm going to add it and the resources you get have a look on them and
try them all.