[MUSIC PLAYING]
You might have remembered seeing in some of the scans
that we've done either Nessus previously in vulnerability
assessments or most recently when we
were going through ZApp and some of the other tools,
scanning the web app.
Well, cross-site scripting is neat.
It's a bug that has implications that you're basically running
code on someone else's website.
If you do that properly, you may get access
to the server itself, or you may get access to information
that's also presented on the site
that you're not supposed to get access to.
But because you can run a script--
you can run JavaScript on the site that wasn't intended--
you might be able to do some stuff.
So let's play around with it and at least see
some basics of what it does and learn a little bit
about a tool.
Let's grab our IP address.
And we're on the .2.
The web servers can be on .3, and we can just
run Nmap on that to double-check.
Yeah, the port is open.
Let's take a look.
Yep, we got Burp on.
There's nothing touching it.
I turn it off.
That'll help.
All right, it's Mutillidae, which is a nifty tool.
It's OWASP.
It's open-source.
You could run it on your own machine if you want,
but you don't get to do the lab just like me here
if you do that.
So play with it here.
It's fun and easy.
And it's all can be good already.
And what we're going to do--
in here, there's all the different times
that they've revalued OWASP.
We're going to look at cross-site scripting
and reflected first order.
And we're going to use this DNS lookup.
Now, this page would do a reverse DNS lookup.
You could do google.com.
We are sandbox, so it's not actually going to lookout.
Let's do a Burp.
Turn on the proxy.
Sorry, I have FoxyProxy reach out to Burp.
Now, if I put something in here, you can see on the page,
I put in google.com, and it reflected down here.
So it's running some sort of script
where it keeps it internal.
And we've got some sort of code in our URL.
So let's see exactly how this one works.
Let's just do helloworld.
And it caught it.
I've go to the proxy, and we can see, OK, it passes it down here
through a POST information.
OK, awesome.
So we've got target_host is helloworld.
That's what I put in there.
We're going to use this neat tool called cross-site scripter
xsser.
Some cool little ASCII art, but it
says cross-site scripter is an automatic framework
to detect, exploit, and report cross-site scripting
vulnerabilities in web-based applications.
So we can run that with -url--
two tacks.
It's right there.
--url and, quotes, http://.
We still have that guy.
I'm going to steal this right out of the get request.
Close those parentheses.
And we need the payload, and because this one
is passed as our POST request, we'll
steal it right out of here.
And we have to go back and replace what
we passed in this helloworld.
And for cross-site scripting, you do XSS in that place.
And that's going to represent a variable.
And the same way that intruder, you
put that squiggly, in some other tools,
you will put in a variable like this.
And let's just see what it finds.
All right, it is vulnerable.
What did it do?
Looks like it ran this payload right there.
I'm just throwing in this hash to see what would come up,
and it says it's vulnerable.
OK.
That's neat.
Let's try and see how vulnerable it is, so --auto.
This is going to try a lot of vulnerabilities
or a lot of payloads, rather.
All right, it ran 1,291 injections,
and they were all successful.
So it's very vulnerable.
It's almost like it was designed that way so that I could
show you all the neat things.
Well, we did auto, and that's cool.
Let's try a custom script, custom payload.
I'm going to run script like this.
If you do HTML and you want to run script--
HTML scripts, you do it like that.
And then you put whatever you want it to do in between.
So we'll run this alert function, alert 1.
And this is pretty elementary, but if it works, it works.
We can do better in the future, and we should.
You can make your alerts or your payloads
more useful, but for this example,
so it's easily repeatable.
We're going to go with that.
So we had intercepted.
We found that it was vulnerable, boom, so right there.
We're going to take this payload that it used.
A URL encoded this.
You see that?
And we're going to play it right back in here.
You see that?
Boom.
with that.
I threw it in there instead of the helloworld.
And now, if we forward it, I look over here,
and we got this alert.
Window with a 1 in the middle.
Success.
Great success.
All right.
Let's try another one, another page.
This did it through a POST request.
Let's look at cross-site scripting
reflected, and we'll go with this poll question.
Yeah, yeah, just forward it on.
What was that?
All right.
We will pass just an Nmap.
I'll turn off intercept for a second.
We send that.
It looks like something is already caught.
Awesome.
Well, it said your choice is Nmap.
Let's see what's going on here.
Let's actually intercept this.
Let's try it again.
What's been passed?
We've got this PHP session showints.
And this is passing it through a get
request with variables in the URL and maps in there,
which is why it showed up.
All right, let's play with this in cross-site scripter.
It's going to be very similar.
But instead of all this payload information,
we're going to pass it through the URL.
So it's just still a URL--
index.php, and it's got the page here.
That's awesome.
Question mark all the way through, awesome.
Pass it back there.
Though we need to replace Nmap because that
is our actual variable with XSS.
See there in the bottom right?
All right.
Replace that.
Let's get quotes.
Let's see if it's vulnerable.
And it looks like it is.
It found one.
It passed it.
See how it did that.
Very neat.
Let's see if we can do a custom again.
Fp and script and then alert 1, and close
the script and some HTML for you right there.
And found-- looks like it does work.
It's putting it now in the payload,
and we can just use this guy right here.
I'll just copy that.
Pump that into Burp.
Replace it in our request.
So now, we've got that script URL encoded right there.
Let's see if it works.
We'll forward it on.
And hey, we get an alert with a 1.
Huzzah.
And it keeps opening him.
Very interesting.
Well, now, alerts with a 1 are not all that exciting.
And that's one of the classic faux pas
when shown off cross-site scripting.
It's like, OK, it's neat that it did that.
Now, what's the applicability to me?
We're going to get into that in the web app penetration
testing for pathway.
This course in pen testing student
is just to show you a little bit.
Get you a taste of the web app portion
so that you can be at least an effective junior pen tester
in the big scheme of things.
If you are doing lots of web pen--
web app pen tests, then I suggest you dive deep
into some of that.
And this is, again, a taste of that.
So there's a whole other course, and I will probably
see you in that course.
And let's finish out some more of these labs here now.