OK, now let's go ahead and have a look on the medium security level and see if we can exploit this
third crosseyed scripting vulnerability.
Now, before you do anything, because this page will automatically contain code that will run every
time the page works, you can go to set up and reset database.
This will basically reset, reset everything.
And when you go back to the stored exercise, nothing is going to work because all the records will
be deleted.
Now, I'm also going to go to the security and I'm going to set the security to medium submitted and
go back to our stored.
Now, in the medium security level, the message text box is not injectable, and we'll talk about that
in the next video.
For now, I'm all I'm going to try to inject in the name.
So first of all, we're going to try our code that we always use, so it's just not the normal code
with capitalizing some of the letters.
And you can see that we can't really write much in the name because it's limited to 10 characters,
this can be easily bypassed by right click inspect element to see the code.
And then we're going to change the max length here to 100.
Then we can put 100 characters in here.
So, again, I'm just going to paste my code and I'm going to put anything here, sign the guestbook.
Now, as you can see, we managed to bypass it just like that.
What I also want to show you is how to run one of these discovery payloads without using a quote.
So some websites would use filtering on single quotes or even double quotes and they'd be removing them.
So what you could do is you can try to use this function, shrink from charcoaled, and instead of pulling
a string in here exactly the same way that we did with school, what we used Heggs, in this case,
we're going to convert this string or the text to char code so you can do that from Google if you just
Google charcoaled calculator.
And I'm going to put this link in the description, we're going to use the first one and I'm just going
to put I'm going to call this one access to so we don't get him mixed up with the first one.
And I'm going to get its code.
So this is it's code.
We're going to copy that and we're going to substitute it in here.
And then we're going to run this.
So this is going to be normal, and I'm also just I made one of the pieces small in here and I made
one of these is small just so that we can bypass any filters if they're checking for a script.
And then we're using instead of putting the text in here between these two brackets, we're actually
saying straying from our code.
So basically decode this code and then run it as a string.
So let's go ahead and run this and see if it works.
Now we're going to add it again.
We're going to have to change the name to 100 in here.
And then I'm going to inject it, put anything in here, sign it.
This is the first access, the first entry.
And as you can see, our second entry is being executed.
And we managed to execute this second entry without putting any quotes in the payload.