Instructor: In this lecture 2 2
and the next few lectures, 3 3
we're going to talk about a vulnerability called XSS. 4 4
XSS is short for cross site scripting. 5 5
This type of vulnerability allows an attacker 6 6
to inject JavaScript into a page. 7 7
So JavaScript is a programming language 8 8
and using this vulnerability, 9 9
an attacker would be able to execute code 10 10
written in JavaScript into a certain page into a website. 11 11
JavaScript is client-side language 12 12
so when the code is executed, 13 13
it will be executed on the client on the user, 14 14
on the person who's browsing the web page. 15 15
It's not gonna be executed on the server 16 16
so even if your code results 17 17
into giving you a reverse shell, 18 18
the shell will be coming from the user 19 19
who's browsing the page 20 20
and it's not gonna be coming from the website. 21 21
So any code you write in JavaScript 22 22
will be exploited or will run on the target user 23 23
on the people who see the pages 24 24
and it's not on the web server. 25 25
So the web server is only gonna be used as means 26 26
of executing the code or delivering the code. 27 27
There is three main types of XSS vulnerabilities, 28 28
persistent or stored, reflected and DOM based. 29 29
The stored XSS gets stored into the database. 30 30
So the code that you inject will be stored 31 31
into the database or into the page 32 32
so that every time any person views that page, 33 33
your code will be executed. 34 34
And the reflected one, 35 35
the code will only be executed 36 36
when the target user runs a specific URL crafted 37 37
or written by you. 38 38
So you'll be manipulating some sort of URL 39 39
and send it to a target 40 40
and when they run that target, 41 41
when they run that URL, the code will be executed. 42 42
The DOM based results from JavaScript code written 43 43
on the client. 44 44
So the code will actually be interpreted 45 45
and run on the client side 46 46
without having any communication with the web server. 47 47
These could be very dangerous 48 48
because sometimes web servers apply some sort of security 49 49
and filtration to check for XSS 50 50
but with DOM based, the code never gets sent 51 51
to the web server so the code will be interpreted 52 52
and run on the web browser without even interacting 53 53
with the web server. 54 54
And these will be present into websites 55 55
that update their content with that refresh. 56 56
So we've all used websites where you put your username, 57 57
for example, and it loads in straightaway 58 58
without having to check with the web server 59 59
or you do, you put some sort of a string 60 60
and it does a search without communicating 61 61
with the web server 62 62
or it does something without communicating 63 63
with the web server. 64 64
So if you're able to inject into that, 65 65
then this injection will not be validated 66 66
so it'll be executed straightaway 67 67
and bypass all validations.