All the javascript injections that we've done so far we used to inject them like this or we used to
actually inject them in the hasty code and we used to have to put descript alert exercise script or
put anything in here depending on the cheat sheet that you shared with you.
Now I've said earlier with skill injections the payload or the exploit can vary from website to website
dependent on the way the website is programmed or the page is programmed.
And exercise is the same so you always need to approach the Web sites and think about it in a general
idea and try to exploit it depending on the page itself.
And don't always just copy and paste the exploits or the payloads and to do that I'm just going to show
you another example today.
And we're going to do it in Matel day and we're going to go to the injection and I'm going to go to
the javascript injection and to the password generator.
Now what this page does basically you click on the generate and it just generates random password.
So there are a lot of Web sites on the Internet that just do that for you.
Looking at this Web site it's almost this password is for anonymous looking at your elk we can see that
it's given a user name and the user name is given and they are all in the username parameter and it's
given anonymous so we can just change that name to a name we want.
So for example if we change that is a
Esselmont that the password is being generated for zayd.
And if we generate it's going to be generated.
Now note that whatever you write in here is being displayed here and this should instantly tell you
that maybe this could be vulnerable to an Access vulnerability because whatever your type is being displayed.
So let's try and use the same exploit that we always use and try to get it injected in the code and
the page.
Now as you can see the exploit didn't run so we didn't actually get a pop up box telling us that there
is an excess in the page but something went wrong.
As you can see now some of the codes being thrown at the page this shouldn't be shown in here.
You've seen in the basic case when you just put a normal name you don't actually see this code.
So that means something is happening something is going wrong in this page.
So let's try to inspect the element
and I'm just going to make this bigger.
Now what they want to focus on is the part of the code that's been thrown in here on the screen so I'm
going to right click it and again inspect element just so that we get navigated automatically to her
that is in the code and I'm going to go down
and I can see that this part of the code is being broken.
We usually add the script tags ourselves when we when we try to inject like you'd like to see in here.
But what's happening in this page it's automatically trying to put what we import our user input inside
to script this one and this one.
So first of all we know that we don't need these
because they're already there.
Also note that our code is being injected here so this is my code script alert exercise.
This is what I entered for the username and you can see that this is being placed inside a single quotation.
So in order to exit this quotation mark I'm going to add one in my exploit.
OK so that's going to close this for me and then I remove the script so it's going to become alert access
which looks really good.
And then we have the end of the script here.
So let's have a look again on the code so you have the first line of saying document that get that get
element by ID.
Now I actually don't know how to program in javascript so you don't need to be a javascript programmer
but you just need to have like a general idea on how this is going to work.
So we can see that this is the first line of the code and it's saying this in our haste M-L is equal
to this password is and whatever we import between the two quotes.
So what we did we closed this.
And then the next line is going to become our alert exercise.
So in javascript to end one line you actually have to add a semicolon.
So we're going to close and add a semicolon in here and our exploit.
And what this will does it will close the code here and it will execute this as another line as the
next line of the semi-colon here at the end just in case.
And we're going to copy this.
I'm going to inject it and I'll show you what the code looks like.
After we injected it will become even clearer.
So I'm going to inject it here.
Now as you can see there is nothing but if we click on the generate now looks like there's something
still wrong.
So we still didn't really inject it properly.
Let's have a look on the code again.
So again right click inspect element and we're going to go down to where the codes for the user right
here.
And this is what our code looks like now.
So it's saying try Documenta again get element by ID.
And this is TELL and this is equal to this password is for.
We close that.
So that's really good.
We added a semicolon purrfect and then we said alert access.
Very good semicolon.
Perfect but then we have this single quote and this semi-colon.
And these are coming from the original code.
So these are used to close this statement originally.
So they're actually being hardcoded or inserted by the code in the page.
So all we have to do is do like what we used to do with the SPL injections and just the comment here
to comment everything that comes after this so that it doesn't break our code.
So again I'm going to copy this
paste it in here.
And as you can see now our code runs and we manage to run javascript code on the target website.
Now you can share this link with any javascript code you want and that will be executed on the target
person on the person that runs this link.
So you can go ahead and look up any types of codes or javascript or you can use beef like I'm going
to show you in the next lectures.
So the take home message from this lecture is the way you exploit vulnerabilities not only job not only
access or Asgill injections any vulnerability is going to vary from website to website so you have to
always think about it maybe you look at the source code look at how the data is being transmitted between
the websites and try to adapt your exploit to that specific web page.