So now, guys, we are again inside the Blooey in this lecture.
We are going to test what exercise is taught based in the medium setting so far that you need to change
the security to the medium.
And now click on Submit.
OK, so now we're inside The Exorcist also simply try to try to enter our last payload here, which
was a script.
A script alert.
Like, I'm going to give one.
A script, let's close this.
OK, let me copy this so that I can use it later, not try to run this.
So when you try to run this, as you can see that what it is doing here is this is simply filtering
of a script.
OK, OK, so this thing is clear that this is filtering a script.
So as we did in the case of excessive Reflektor, we we have simply change over into capital letter
and then try to run that particular book that we have from that pilot.
And that was running very, very good and that was running as our needs.
OK, now let's try that thing again here.
Let's see, is it working here or not based?
It's the Dawe.
OK, so now let's try to make this as capital.
As capital not.
So when you see what it is doing, it is simply filtering again.
So guys, let's see its source code, what it is doing here.
So when you see its source code, what it is doing here is this is the place is this is doing same as
it was doing in the case of excess as reflected.
But let's see, something else is they are not so nice to us.
Was a good match.
OK.
OK, ok.
It is also a striped dog.
And I said it is adding the slices here.
OK guys now.
And this is in case, OK, guys, so what they are doing here is they are simply adding the filter in
place of message body, but in case of name, what they are doing, they're only filtering is crap.
So now let's try to exploit it in the field of name.
OK, guys.
All right.
So this is the name Phil.
So what I going to do is I'm going to simply right.
Click and go to inspect element.
So when you go to inspect Element.
You will see this kind of interface.
OK?
So now, guys, let me make it zoom so that you can see it, this particular thing, in my view, OK?
So when you see here we are currently here, the maps input name this name texta size 30 and max length
is ten.
So the thing that we need to do here is we need to change 200, OK, because we want to enter more characters
than 10.
So that is why for the convenience, I just changed 10 to the hundred.
So now let's try to exploit this.
So how we can do that.
So what I'm going to do here is I'm going to say, OK, this is also a script.
So I'm going to, uh.
OK, let me paste it here, OK?
Now let's change as to capital and as to capital.
OK, and neither here.
Hello.
So now let's try to run this.
So when you hit enter, you will see this is doing as per our requirement that that means it is taking
over input and it is simply executing it on the server level.
Whenever I we will get back to this, we will have the same address.
Now let's try to get back again to it and it will give you an error like this.
So this is how you can exploit it in case of medium by just using that inspect element and inspect element.
And you cannot when you have the choice that you are having to fill and one field is restricted by the
characters.
Another for you is a restricted by the slicers.
So what you can do here is you can simply use inspect element in place of the character case.
OK, so now let's try to see what it is inside the high security.
So now click on Summit.
So when you click on segment, let's get back to Starburst.
So when you see the source.
So now let's try to run that particular command that we did in the case of Mirriam so far that just.
OK, let me go back to inspect Element.
So when you go back to inspect Element, we need to change it again.
OK.
OK, to double click here, you will see this thing.
100 -- enter.
So now I will be able to enter.
Come on.
So let's try to exploit this.
Let's see, is it working or not?
In case of this.
Hello, not hit enter or so when you hit enter, you can see here what it is doing here is this is simply
changing all the things inside, like with the help of is.
OK, it is adding these many characters in between these, these things so that it can not be run.
OK, guys, let's see.
It's the view source.
So when you make it as as you can see, let's see the name.
It is text message.
As we all know, that inside method, they are doing the same as they did in the last millennium, but
the same thing they are also doing in the case of Nemo.
So they are simply adding the glasses and they are simply a real escape string.
What they are doing, they are changing.
They are changing in the game.
They are tuning in, steaminess special characters, whatever we have entered there.
OK, so this is how it works in case of a high.
That is why we are not able to exploit this.
So this is, guys, how you can simply.
Exploit accessors if elected and exercise torbay's.
So this was all for this lecture.
I hope you guys understand it, how it's all work and thank you for watching this lecture.