Zaid: So let's talk about how to discover 2 2
these kind of vulnerabilities. 3 3
Very similar to SQL injections, the way to do this is 4 4
you browse through your target and try to inject 5 5
any text box or 6 6
any url 7 7
that looks similar to this. 8 8
So whenever you see a url with parameters, 9 9
try to inject these parameters 10 10
or try to inject into text boxes. 11 11
So let's have a look on a reflected XSS example. 12 12
So these are the none persistent, not stored vulnerabilities 13 13
where you have to actually send the code to the target, 14 14
and once the target runs the code, 15 15
it will be executed on their machine. 16 16
So let's have a look on our DVWA website. 17 17
And I'm just gonna log in. 18 18
And then we're gonna have an example of a reflected XSS. 19 19
So as you can see now, you can put your name here 20 20
for this text box, 21 21
and it's just gonna say 'Hello'. 22 22
Now this is obviously just an example 23 23
but the idea is you can inject into text boxes. 24 24
Also if you have a look at the url here, 25 25
you'll see that it's a get, 26 26
so you can inject into the url as well. 27 27
So let me start a Leafpad. 28 28
And let's try to inject XSS code on this 29 29
and see if the code will be executed, 30 30
or JavaScript code, sorry. 31 31
So what I'm going to use is a very simple script, 32 32
so we're using the script and a slice script tag 33 33
now there is a lot of ways into discovering 34 34
these kind of vulnerabilities 35 35
and a lot of ways to bypass filters, 36 36
but for now we're just having a look at the basic case 37 37
where we can inject a normal script. 38 38
And I'm going to say 'alert', which is just a function 39 39
to give an alert to give a text box, 40 40
and I'm gonna say... 41 41
'XSS'. 42 42
So I'm gonna click on 'submit' 43 43
and we'll see if this code will be executed. 44 44
And as you can see now, it's actually executed my code. 45 45
So instead of saying 'Hello Zaid' here, it said 'Hello' 46 46
and my code has been executed and it produced this 'XSS'. 47 47
So we can do the same here, if you have a look on the url, 48 48
it actually already did it for us. 49 49
But if we look at the url here, 50 50
it's just gonna be a bit bigger there. 51 51
We can see that the name has been 52 52
obviously all of these characters are just 53 53
html escape characters. 54 54
And now if you send this url to anybody, 55 55
whoever views that url, the code will be executed 56 56
on their machine and it's gonna say 'XSS'. 57 57
So let me show you here, 58 58
you can also inject this in the url, 59 59
I just wanna sow you the whole idea of that. 60 60
So we have script, slice script XSS. 61 61
And if I hit Enter, the code will be executed. 62 62
So as I said, we can copy this 63 63
and send it to a certain person 64 64
and once they run that code, this code will be executed 65 65
on their machine.