OK, now let's have a look on a exercise example.
Now start the exercise is very similar to unreflected one.
It allows you to inject JavaScript code into the browser.
The code is executed on the people that visit the page.
The only difference is with with the reflected, you have to send the you are out to your target.
So the target had to actually click on a URL for the exploit to run or for the code to run.
And the stored access, the code will actually be stored into the database or into the page, so every
time any person runs that page, they will see your code and your code will be executed.
So you want me to interact with any users or send them anything?
Therefore, this could be much more dangerous than reflected excess.
So let's have a look on this now.
I clicked on the excesses here on the left and you have this page and this page just allows you to add
a message to the system.
So I'm going to put my name aside.
We're just going to do a normal test first and we're going to put a message board, for example, and
then I'm going to sign the guestbook and you can see that they've I did a message called Message Body.
So if you would go to hear.
And to another machine, so this is a different machine to a different place, and if we go into the
or we can see that there's two entries.
So the entries are being loaded from the database and they contain the entries in the database.
So if we managed to inject code in here, then any person who runs this page, the code will run it
without even having to send that person anything.
So let's try to inject stuff here.
So let's put my name, Azad.
And I'm going to try to put my coat in here, so I'm going to try to inject into the message, I'm going
to put it in a script, I'm going to use the exact same test code that we used in the previous video.
Just a message saying exercise.
Again, very basic code.
But it serves for the purposes of this video, and we're going to stay alert.
Excess.
And I'm going to try to sign the guest book and as we can see now, I got the exercise here, but the
real magic happens when a normal person.
So let's just go home first and let's assume this is just the normal website and people just are coming
and browsing it.
And once they're going to go to the guest book, JavaScript code will be executed on their system from
that website.
So the code is coming from that website and it's going to be executed on every person that visits this
page.
Again, we're just showing a proof of concept here, and future videos will show how to further exploit
this kind of vulnerability.