So let's talk about how to discover these kind of vulnerabilities very similar to Ezekial injections,
the way to do this is you browse through your target and try to inject any text box or any other URL
that looks similar to this.
So whenever you see your URL with parameters, try to inject these parameters or try to inject into
text boxes.
So let's have a look, unreflected as accessors example.
So these are the non persistent nonstate vulnerabilities where you have to actually send the code to
the target and once the target runs the code, it will be executed on their machine.
So.
Let's have a look on our website.
And I'm just going to log in.
And then we're going to have an example of a reflected excess.
So as you see now, you can put your name here for this text box and it's just going to say hello.
Now, this is obviously just an example, but the idea is you can inject into text boxes.
Also, if you have and have a look at the URL here, you'll see that it's a get so you can inject into
the URL as well.
So let me start this.
And let's try to inject exercise code on this and see if the code will be executed or JavaScript code,
sorry.
So what I'm going to use is a very simple script.
So we're using the script and script tag.
Now, there is a lot of ways into discovering these kind of vulnerabilities and a lot of ways to bypass
filters.
But for now, we're just having a look at the basic case where we can inject a normal script.
And I'm going to say alert, which is just a function to give an alert, to give a text box.
And I'm going to say.
As so I'm going to click on Submit and we'll see if this code will be executed.
And as you can see now, it's actually executing my code, so instead of saying Hello Z here, it said
hello and my code has been executed and it produced this exercise.
So we can do the same here if you have a look at the URL.
It actually already did it for us.
But if we look at the URL here, it's just going to be a bit bigger there.
We can see that the name has been obviously all of these characters are just the animal escape characters,
and now if you send this out to anybody, whoever views that you URL what the code will be executed
on their machine and it's going to say exercise.
So let me show you here, you can also inject this in the your eye.
I just want to show you the whole idea of that.
So we have script slash, script access.
And if I had enter, the code will be executed.
So, as I said, we can copy this and send it to a certain person and once they run that code, this
code will be executed on their machine.