Okay now let's have a look on start exercise example.
Now the exercise is very similar to our reflected one.
It's it allows you to inject javascript code into the browser.
The code is executed on the people that visit the page.
The only difference is with the reflected you have the sense that you are out to your target.
So the target had to actually click on a U R L for the exploit to run or for the code to run and the
stored access the code will actually be stored into a database or into the page.
So every time any person runs that page they will see your code and your code will be executed.
So you want me to interact with any users or send them anything.
Therefore this could be much more dangerous than a reflected exercise.
So let's have a look on this now.
I clicked on the access store here on the left and you have this page and this page just allows you
to add a message system.
So I'm going to call my name as a we're just going to do a normal test first and we're going to put
a message at you for example and then I'm going to sign the guestbook and you can see that they added
a message called message body.
So if you go to hear to another machine.
So this is a different machine to a different place.
And if we go to The Exorcist or we can see that there is two entries so the entries are being loaded
from the database and that they contain the entries in that database.
So if we managed to inject code in here then any person who runs this page the code will run it without
even having to send that person anything.
So let's try to inject stuff here.
So in this with my name as a and I'm going to try to put my code in here so I'm going to try to inject
into the message.
I'm going to call it a script.
I'm going to use the exact same code test code that we used in the previous video just a message saying
exercise.
Again very basic code but it serves for the purposes of this video and we're going to say it's
access and try to sign the guest book.
And as we can see now I got the exercise here but the real magic happens when a normal person.
So let's just go home first and let's assume this is just the normal Web site.
And people just are in and browsing it and what's they're going to go to the guestbook javascript code
will be executed on their system from that website.
So the code is going from that web site and it's going to be executed on every person that visits this
page.
Again we're just shown a proof of concept here in future videos will show how to further exploit this
kind of vulnerable.