Now let's talk about how we can prevent excesses vulnerabilities the way these vulnerabilities happen
is because whenever a user enters something into a text box or into a parameter that input is displayed
into the Hasyim else it is treated as if it's part of the page and therefore if there is javascript
in it the code is being executed.
So to prevent this exploit the best thing to do is to try and minimize the usage of untrusted input.
So anytime a user input something or anytime something is input from parameters try to minimize that.
Also make sure that you always escape wherever that's going to be displayed or used into the hasty e-mail
page because Access can only be injected into places where things are displayed on the page.
But it can also be injected into parameters of certain elements of the Hasyim page.
So what I mean by scaping is converting each of these characters to what they would be represented by
in haste.
You can do that using scripts and you can do that using your own script.
Now let me show you how this happens now I'm here as my vulnerable Web page that we were using and I'm
going to go to this third one.
And obviously you can see that every time you click on that the exercise runs.
So let's inspect this element.
Now this element is where we injected our alert.
And if you right click and go on inspect element it will show us the Hastey amount of this page or the
out of this particular element right here highlighted.
So I'm going to make this bigger and if we look at it right here you'll see that we have the name and
that Zayde and then the other input which is the message.
It's a script and the script where the script does it does alert exercise so it's exactly what we injected
into it when we did that comment.
So every time we were on this page this piece of code gets executed.
So we need to do is we need to make sure every time a user enters something and that something will
be displayed on a page or that something will be used somewhere in the argument.
So even the idea here or even the Atri the idea is just for example is a parameter of the day.
It's not the stage you never see this ID but this is this can be injectable can be injected as well.
So hackers can actually try to inject stuff into the parameters.
They can try to inject stuff into the image attributes for example they can do an image and inject stuff
into the source or into the you or else.
So this is just an example here.
And every time user's input is going to be used anywhere on the page so even if you don't see it if
usually don't see it you need to make sure that you escape that input and make sure that it does not
contain any code and if it contains any code that it's converted to its history to be equivalent once
you escaped this you'll actually see this in the message.
So you see the message as script alert exercise but it will never be executed.
The script will never actually be executed on the target person when they run it.
And this is exactly what the high security level atonements.
So let me go through the security settings.
And let me close this and I'm going to send this to a high
submitted and we'll go back to our reflected this the same measurements are taken in the reflected and
in the story.
And now if we try to inject any of our codes that we were doing before for example if we try to inject
this script so script with exercise and then we close the script you'll see the script exactly the same
way that you would have seen a normal name.
So if we say Zayde here you'll just see my name and if we inject our script you'll see it appear in
as if it's a normal name it doesn't appear.
You don't only see what's between the tags and then the code doesn't even get executed.
If we look at the source you'll see that you see all the tag so you can see the script.
You can see the close of the script tag and everything is being injected properly.
So you think that this should work but it doesn't work because the Web site or the web page or the browser
knows that these tags are should be treated as Hastey mild characters and should not be treated as part
of the code.
And this is all thanks to a function that's being used here which is called the Hasyim of special characters.
So it's all thanks to this function.
So whatever you're putting in the name it's been filtered through this function.
Now this function will iterate over each character that you entered and it'll tell Hastey email or the
browser it'll change it to its equivalent in haste DML code.
Therefore the browser will know that this is not part of the code.
And this is part of what should be displayed on screen as text.
And this way no matter what you try to inject it will be converted to a stream of code which will just
be displayed on screen like normal text or normal characters.
Now as a user to prevent yourself from being used into an exercise attack.
Now you are coming to you will probably look like you are out of a trusted website.
For example let's assume that you work in a company and there was an exercise in your company and you
are logging into your company and the code gets executed on you.
Then there isn't much you can do yourself but you need to be careful with beef we so in order to exploit
the vulnerabilities we were shown for example a fake update.
So make sure when you if you get an if you get a message always that there is an update.
Make sure you actually go to the website that provides that application.
So if Firefox said that there an update go to the face to the website of face of Firefox and see if
there is actually an update and if there is download it from that website don't download it from the
notification that you got.
Also make sure you're downloading it from a hasty CPS website and once you download it you can inspect
it and check it the same way that we've seen before.
To make sure that there is no back doors or anything in it.
You can also check the five some to make sure that the file hasn't been manipulated while it was being
downloaded the same way when we did the fake Facebook log in when you were with beef.
So what you can do is whenever you're told that you got logged out and please log back in again.
Ignore that.
Go to Facebook dot com.
Make sure it's going through the CPS and then log into Facebook so always try to be careful with notifications
popping up telling you you need to do stuff.
Always be wary and never trust them.