Now, let's talk about how we can prevent access as vulnerabilities, the way these vulnerabilities
happen is because whenever a user enters something into a text box or into a parameter, that input
is displayed into the HTML.
So it's treated as if it's part of the page and therefore, if there is JavaScript in it, the code
is being executed.
So to prevent this exploit, the best thing to do is to try and minimize the usage of untrusted input.
So any time a user input something or anytime something's input from parameters, try to minimize that.
Also, make sure that you always escape whatever that's going to be displayed or used into the HTML
page, because exercise cannot only be injected into places where things are displayed on the page,
but it can also be injected into parameters of certain elements of the actual page.
So what I mean by escaping is converting each of these characters to what they would be represented
by an HTML, you can do that using scripts and you can do that using your own script.
Now, let me show you how this happens.
Now, I'm here at my vulnerable Web page that we were using, and I'm going to go to the third one.
And obviously, you can see that every time we click on that, the exercise rounds, so let's inspect
this element now.
This element is where we injected our alert.
And if you right.
Click and go on inspect element, it will show us the hasty HTML of this page or the HTML of this particular
element right here highlighted.
So I'm going to make this bigger.
And if we look at it right here, you'll see that we have the name.
And that Zaid.
And then the other import, which is the message, it's a script and the script where the script does
it does alert exercise.
So it's exactly what we injected into it when we did the comment.
So every time we were on this page, this piece of code gets executed.
So we need to do is we need to make sure every time a user enters something and that something will
be displayed on a page or that something will be used somewhere in the elements.
So even the idea here or even the the idea is just, for example, is a perimeter of the div.
It's not the state.
You never see this idea.
But this is this can be injectable can be injected as well.
So hackers can actually try to inject stuff into the parameters.
They can try to inject stuff into the image attributes.
For example, they can do an image and inject stuff into the source or into the URL.
So this is just an example here.
And every time a user's input is going to be used anywhere on the page.
So even if you don't see it, if you usually don't see it, you need to make sure that you keep that
input and make sure that it does not contain any code and if it contains any code that it's converted
to its equivalent.
Once you escape this, you'll actually see this in the message.
So you see the message as script alert exercise, but it will never be executed.
This script will never actually be executed on the target person when they run it.
And this is exactly what the high security level implements, so let me go through the security settings.
And let me close this.
And I'm going to set this to high.
I'm going to submit it.
And we'll go back to our reflected, the same measurements are taken in the reflected and in the.
And now if we try to inject any of our codes that we were doing before, for example, if we try to
inject this script, so script alert exercise and then we close the script, you'll see the script exactly
the same way that you would have seen a normal name.
So if we succeed here, you'll just see my name and if we inject our script.
You'll see it appearing as if it's a normal name, it doesn't appear.
You don't only see what's between the tags and then the code doesn't even get executed if we look at
the source.
You'll see that you see all the tags, so you can see the script tag, you can see the close of the
script tag and everything is being injected properly.
So you think that this should work, but it doesn't work because the website or the Web page or the
browser knows that these tags are should be treated as HTML characters and should not be treated as
part of the code.
And this is all thanks to a function that's being used here, which is called the HTML special characters.
So it's all thanks to the dysfunction, so whatever your input in and the name, it's being filtered
through dysfunction.
Now, this function will iterate over each character that you entered and it'll tell HTML or the browser
it'll change it to its equivalent in HTML code.
Therefore, the browser will know that this is not part of the code and this is part of what should
be displayed onscreen as text.
And this way, no matter what you try to inject, it will be converted to HTML code, which will just
be displayed on screen like normal text or normal characters.
Now, as a user, to prevent yourself from being used into an excess attack, now you are all coming
to you will probably look like you are all of a trusted website.
For example, let's assume that you work in a company and there it was, an exercise in your company
and you are logging into your company and the code gets executed on you.
Then there isn't much you can do yourself, but you need to be careful.
So with beef, we sell in order to exploit the vulnerabilities we were showing, for example, a fake
update.
So make sure when you if you get if you get a message always that there is an update, make sure you
actually go to the website that provides that application.
So if Firefox said that there is an update, go to the to the website office face of Firefox and see
if there is actually an update and if there is downloaded from that website, don't download it from
the notification that you got.
Also, make sure you're downloading it from a website and once you download it, you can inspect it
and check it the same way that we've seen before to make sure that there is no back doors or anything
in it.
I can also check the MDVIP some to make sure that the file hasn't been manipulated while it was being
downloaded.
The same one we did the fake Facebook login when you were with beef.
So what you can do is whenever you are told that you got logged out and please log back in again, ignore
that, go to Facebook dot com, make sure it's going through tips and then log in to Facebook.
So I always try to be careful with notifications popping up, telling you you need to do stuff, always
be wary and never trust them.