Welcome to cross site scripting.
This is one of my favorite bugs to hunt for and to find.
So in cross site scripting we really have three that we're going to talk about and this is a popular
interview question you're going to get asked what are the three types of cross-eyed scripting.
OK.
So we're going to cover that.
We're going to cover what they are why they're a little bit different and what they might look like
in code.
And then in the next couple of videos we're going to exploit a couple of these.
So as you see here there are three types of cross site scripting.
We have one which is called reflected now reflected means that it's reflected.
We're going to inject as something malicious.
And what's going to happen is you're going to get a pop up and it's going to be reflected to us.
OK.
It never gets stored on the server.
So the server is going to read the request and then it's going to respond back with that request and
it's going to reflect on the page.
Now if we leave that page and come back to the page again it's going to go away unless we make that
request and be malicious again with it.
Now the opposite of that is what is called stored or persistent cross-eyed scripting.
What that means is we inject a malicious payload and then it is stored onto the server.
So we leave we come back and that payload is still there.
OK.
So we have a stored capability and you're going to see in this course you're going to see a reflected
and a stored.
Now the last one is what is called Dom.
Now Dom stands for the document object model right.
This is in javascript.
So what's happening here is when you are going out and you're injecting this.
So when you go out to a Web site the server is going to show you some HMO is going to show you some
javascript is going to send it back to you in your browser.
Right.
And when you see this in when you want to modify this it's called the DOM.
The document object model.
Now we can exploit that Dom.
And this again is going to be client side so reflected in Dom and both client side and we can attack
specifically the Dom and I'm going to show you more of how that works and what it is here in just a
second.
But those are the three.
One is reflected two is stored in three as Dom cross-eyed scripting.
So let's go ahead and take a look first at reflected cross-eyed scripting.
OK.
Let's say that we have a HP page and we'll just call this index that BHP as an example.
And let's just write out some BHP here it's OK if you don't know BHP I'm just going to show you some
things.
So will this declare BHP and then we'll declare user name as a variable.
And will this say we're going to go ahead and get user name
all right.
And when we do that we're going to echo Hi user name
and then we're gonna kill this.
So that's it.
What are we doing here.
Well let's say we have a situation where we have index that BHP and it looks something like username
equals Keith.
Well what's gonna happen here.
It's going to say hi Heath.
When you come to the Web page right OK.
Well what if we have something like index that BHP in the user name instead is something like this script
alert one script.
Well guess what.
That's going to run javascript.
OK we're declaring that we're running javascript with the script tags and we're going to run what's
called an Alert alert is going to bring a pop up on the browser and it's going to pop up but it's going
to say one on the pop up and this is classic cross site scripting.
All right.
So that is what reflected looks like this would be an example of reflect it.
Now imagine stored the best way to describe stored.
We don't even have to look at code we can just think about it a think about having a blog post and you
can go comment on that blog post or having a form and you comment on that form right.
What if you were to leave something like this script alert one slash script and you left it on a blog
post.
Well every time if the site was vulnerable every single time you went to that page or anybody else went
to that page then guess what.
They would also see that pop up because it's stored on the server side.
Right.
So there's some difference here to talk about when it comes between reflected well really reflective
Dom and stored reflected in Dom require social engineering.
We have to get somebody to open a malicious link in that malicious link might point us or point to us
as an attacker we might have some sort of javascript that we're running in that JavaScript is going
to execute it's going to send a it's going to steal a cookie from a user and it's going to send it to
us and we have their cookie we're gonna go to try to log in as them.
But we need to be able to know the user and then send that send that well crafted link social engineering
and get that cookie stolen right now if it's stored.
We don't have to do anything.
We just put a malicious JavaScript in and we're not going to make it a pop up pop ups or just use for
an example because they pop up we can see them.
But if it's stored we might have the same feature where it's stealing a cookie and that cookie gets
stolen it comes to us.
And guess what you're going to the page you don't even know that it's there you're not looking at the
source code you have no idea what's going on.
It's just sitting there stored on that page so we can be really malicious with that.
There's a lot of different things that we can do across site scripting including stealing cookies is
really the big one.
We can do key logging we can do denial of service.
We can deface a web page.
There's so many different things that we have options with the most common and the best examples are
stealing cookies and doing this javascript kind of pop up as a proof of concept.
So that's what we're going to do with these lessons.
Now before we do that I do want to point out one more thing I want to point out this blog post on Donbass
cross-eyed scripting now Donbass is hard for people to get their minds around it's it's not one that
you find very easily it's kind of complex and I really just want to give kudos to this author who talks
about Donbass cross-eyed scripting and can explain it better than I can.
I'm going to walk you through what's going on here in the code and how you should be able to understand
what you're seeing here.
So there's two things that we need to talk about.
There is one what is called a source and then the other is called a sink and you could see them here
identified in the code.
OK.
Now a source is where you insert malicious input.
So that's what you're malicious input goes your sink is where it is executed.
OK.
So we have a sauce and a sink.
Now what's happening here.
Well we have our source and it says this is just a variable called source and it says hello.
And then they're just putting a hash here.
OK.
Because this decode your eyes you're saying hey we're going to put a hash here.
A lot of modern browsers nowadays will obfuscate this or try to prevent cross-eyed scripting.
So it's just going to say hey allow this hash and we're gonna say OK we've got the hash and what's going
to happen then is we are also going to execute our code here because this is the source.
So if you look down here it is vulnerable again.
We've got the hash at this example Web site.
OK.
We've got the hash and then we put in this what they're doing is they're putting in an image with a
source of test and there is no image that's called tests.
So on the air of that image not loading it's going to pop up an alert box and say cross-eyed scripting.
Now here in the DOM we also are going to have the sync.
OK.
So this div element enter H Jamal is going to be our sync that's going to pull this all down for us
and it's going to be executed right here.
So this is all happening on the client side.
This is a great example of Donbass cross site scripting.
Again this is something that you're going to have to pull off with social engineering just like reflect
it.
You're going to see Donbass the least in my opinion.
You're going to see a lot more reflected you're going to see a lot more stored and a little bit of Dom
based.
OK so you have to understand this this article is great.
It tells you where a bunch of sources are where a bunch of syncs talks about defenses.
I think this is one of the best articles that I have read especially when I was a beginner and I like
to pass on those articles as well.
So I'm going to be putting this down in the description.
So from here hopefully that was a good overview of what this is like.
OK.
So hopefully there's a good overview.
Now you know all you need to take out of this right now is OK there is reflected there is stored and
there's Donbass.
And when you think of reflected reflect that just means that it pops back to you would if you were to
leave the page and come back it would be gone where stored if you're to leave the page and come back.
Guess what.
It's still going to be there.
So in the next video we're going to do an example of stored.
We'll do a stored base and then we're gonna go ahead and cover a reflected one and we should be good
to go.
I'll show you all the different types across site scripting ones they have and there's even a nice walkthrough
for the DOM which I want you to do on your own and kind of get some experience and see how it's done.
And I do encourage you to also look through the other ones and see how they're done as well.
But for now let's go ahead and go into stored and then we'll move on into reflected.