I will come back.
In the previous lecture we created the div around scanner or this run scanner method.
You see that?
Okay.
And now it is time to go and learn something about excesses attack.
So what is excesses attack okay we have excesses.
Excesses means cross site script.
Whenever we are trying to use this kind of attack we are going to use JavaScript, JavaScript code.
So JavaScript is a client side programming language.
So that means whenever you're injecting your JavaScript code to a website that only interact with,
uh, with the client side, okay, with this website, with the user interface.
Okay.
Or with, uh, the thing that user sees, okay.
Not with the server or the thing that is this data is stored in.
So you cannot, uh, use this to interact with server.
Okay.
Only it interacts with client side.
So.
Uh, let's come here.
We have, uh, the excesses.
Okay.
Excesses means cross-site scripting.
Let me cross site scripting okay.
So this is XSS and we have three kinds of XSS attack.
The first one is persistent or also it is called stored XSS okay.
And this uh persistent or stored accesses is a kind of attack that it will store your code into the
database then, and whenever someone's use that website and or that web page, your code will be executed.
Okay, so this is, uh, one of those, uh, thing.
The second one is called reflected accesses.
Okay.
So reflected.
Accesses.
This is a kind of a easiest one.
Okay.
Uh, you're injecting your code into a link or into a browser.
And whenever someone click on your link or use your link.
So the code that you write it will be, uh, executed and you will see the result.
And also we have the third one, which is called Dom based excesses.
So this is another kind that will only interact with the client side, and it is not going to store
on the database.
So okay let's come to this website again the Dvwa here.
First let me go to Dvwa security.
Okay.
Put this to low.
Hit the submit button.
So you see right now it is low.
And let's go and see this reflected one here.
For example, if I write anything like name it and then hit the submit button, you will see it will
give me hello name.
Now if I try to do something else like inject a JavaScript code, let's see if it is possible or not.
So whenever you're trying to inject the right a script JavaScript code.
So you need to put them into two tag okay called script.
And also this one.
And inside this we have something some command.
For example we have one of them is alert.
And whatever you put in this alert it will be shown on a text box okay.
On a text box okay.
It will open a window.
It will pop up a window and then show whatever you want in here.
For example, if I just write X and then if I hit the submit button, now you see that it is popping
up and it is giving me that XSS instead of saying that hello x axis and this is the reflected one.
And also I told you that we can do this with the link.
Okay.
So here you see we have name is equal to script and then alert and something like this.
So we can do that very easy in here.
The same thing that we have done there.
Right here I can do that very easy okay.
For example we have this script.
And also the same thing goes here script.
And in here let's write alert and let's say hi.
And now if I hit enter after a while you will see that the window pop up and say hi.
Whatever you enter here it will show that right in here.
Okay.
So it is the reflected waves.
The next one is called XSS stored.
And in here it will allow you to enter something.
It will store it on the database like this.
For example name is going to be here Name.
And also the message is going to be, for example, hello name.
Now, when I hit enter, you see that this data is still here.
Okay.
And now if I try to enter, if I try to use access stored again, I can do the same thing here.
So name it.
The next one is going to be a script.
So I write the script.
Close the tag and then.
Sorry.
Script.
And inside here write your command.
Okay.
For example it's going to be alert.
Let's say hello.
Yeah.
Now when I hit enter you will see that it shows.
Hello there in here and right here, right now it is stored into the database.
Okay.
And if I move somewhere else.
And then if I, whenever I click here I came here and click on this Excel stored my code that is inside
here stored it will be executed.
Okay.
So now whenever whoever for example this user okay.
Whenever he or she tries to access this access store and then came here click on Access Store and my
code will be executed.
That is here and stored inside this okay.
Here.
So it will be executed all the time until you remove this or someone remove this from database okay.
So it is called stored cross site scripting or stored accesses.
So thanks for watching and I will see you in the next lecture with another tutorial.