OK now let's go ahead and have a look on the medium security level and see if we can exploit this third
cross-site scripting ability.
Now before you do anything because this page will automatically contain code that will run every time
the page works.
You can go to set up and reset the database.
This will basically reset reset everything.
And when you go back to the store it says nothing is going to work because all the records will be deleted.
Now I'm also going to go to the security and I'm going to set the security to medium submitted and go
back to our store.
Now in the medium security level the message text box is not injectable.
And we'll talk about that in the next video for now I'm all I'm going to try to inject in the name.
So first of all we're going to try our code that we always use so it's just not the normal code with
capitalizing some of the letters.
And you can see that we can't really write much in the name because it's limited to 10 characters.
This can be easily by passed by right click inspect element to see the code and then we're going to
change the max length here to 100.
Then we can put 100 characters in here.
So again I'm just going to paste my code and I'm going to put anything here.
Signed the guestbook.
Now as you can see we managed to bypass it just like that.
What I also want to show you is how to run one of these discovery payloads without using a quote.
So some upsides with that use filtering on single quotes or even double quotes and they'd be removing
them.
So what you could do is you can try to use this function strain from charcoal and instead of putting
a string in here exactly the same way that we did with school when we used Hexe and this case we're
going to convert the string or the text to char code.
So you can do that from Google if you just Google charcoals calculator.
And I'm going to put this link in the description we're going to use the first one and I'm just going
to put I'm going to call this one x x x 2.
So we don't get mixed up with the first one and I'm going to get it's code.
So this is code
we're going to copy that.
And we're going to substitute it in here.
And then we'll go on.
So this is going to be normal.
And I'm also just I made one of the piece small in here and I made one of this small just so that we
can bypass any filters if they're checking for a script and then we'll use it instead of putting the
text in here between these two brackets.
We're actually saying a string from Cheraw code.
So basically decode this char code and then run it as a string.
So let's go ahead and run this and see if it works.
Now we're going to add it again we're going to have to change the name to 100 in here.
And then I'm going to inject it.
Put anything in here.
Sign it.
This is the first exercise the first entry and as you can see our second.
And it's been executed and we managed to execute this second entry without putting any quotes in the
payload.