Welcome to this lecture from this lecture we'll just start using this website which is hack this site.
Dot org.
And this is the Web site which will have some of the medicines based on the javascript core will source
for some of the tricks in this submission.
And we'll just get good grips on how this Zabriskie core the works on the real Web site will see how
this can be work on the Web sites on the Labor web site in the upcoming lecture.
But from here we'll just work with the basic mission some of the missions that will be really useful
for the later lectures.
So first of all all you have to do is go to this Web site which is hack this site dot org and you will
just get redirected to this Web site.
And first of all in the left hand side you'll just get the signing button.
So you have to just log on to your date e-mail are just so resistant.
And after registering that the e-mail just makes you do this give the proper e-mail because you're doing
just a check for your e-mail and it'll just send the password to your e-mail.
So after that you just go to the slipped inside challenges.
So always this go here is the javascript mission.
So let me just press on that JavaScript mission.
We'll just get these seven challenges.
Let me just count.
OK.
These are seven challenges.
So first of all we'll just start with these idiots.
So let me just click here to take the challenge so we just click on the left are basically on the wrong
link.
So let me just take the challenge.
So we'll just get this link or the next page which is our first javascript mission.
So here all you have to do is search for the password.
So let me just put random password here so let me say you they mean.
So if I just click to this take password to the same failed.
So now what you do have to do is we have to check for the password which will be the only one password
that will just give us the next mission.
So all you have to do is this press control you from your keyboard or simply you can this get here.
That is a new page source.
So after you do that you will just get this space which will have all of your e-mail documents all of
the link.
And will this go to this part which is basically take password button.
So we'll just sort that simply press control.
It will get this finding base as this sick password.
And if I just say check it will get me these.
Basically this part of the document and it will see here we have the SEC password button over here which
will be this button which is the tech password button and it will just take for this javascript so on
click was the event which was basically invoking some of the javascript code to when you just press
this tech passport button.
So when you space these tech passwords some of the javascript code is going to be executed and here
what it is going to be executed is this sick method.
So this sick method will be executed and it will just take for some of the password and it will just
give you that.
So first of all what we're doing here is this sick method is basically is this fund sent over here.
So this tech method has to be passed some of the values which is this interred in this field.
So this field will have some values and that values will be passed to this sick method.
So this tech method is responsible for taking out a password.
So here is the some conditionals and you will see that if he X the X is basically the password that
you this hit here.
So if that yucks which is basically our password is equal because this double equal is basically for
you equal to.
And when that password is equal to cookies you'll get alert which is basically saying that you win.
Otherwise it will say false.
That means our passwords would be cookies all in the lowercase.
So let me just pass that cookies.
Me basic password then to say win.
That means you have this redirect to this.
Congratulation page because we just passed the cookies.
So that means what we did here was we just passed the cookies as a password and it has get us a load
of which was basically simple dialog box.
So here we just made use of this tech method to take for our password.
So if you see in these windows the DOT location.
So this was responsible for creating a Udell.
So if you just go back here you'll see that you are all over here which is saying that let me just remove
this part and go back to level 1 then it will get you the same mission.
So after this mission it will just indicate this window's location basically this is responsible for
creating the all.
So it is saying users pass in this level password.
So it is Tim is saying you will just pass here.
Let me paste first this in here.
You'll pass cookies because cookies is our password.
So this window is a dot location is responsible for creating the UI.
So we just pass label password here and that password field which is basically with this perimeter.
So just remember anything with this question mark after this question mark is the perimeter.
So here we have the perimeter.
So if this go on the Google let me say something like Let me see Sachin Tendulkar.
So it would seem that we have the bad image over here that is with the question mark.
So you are searching on the Google and it is saying that we knew this space.
Sachin Tendulkar you just get this link.
So what we have here is the question mark and the client.
So clients a Firefox and an order parameter here is Q which is basically a question and it is say searching
a basically query for the Sachin Tendulkar.
That means that this is the end the barometer which is Q. And we have here that is a label password
which is a barometer.
So in this label password if you pass cookies then it will say that so it hasn't.
But it should work.
And let me say something is happening over here because it is not redirecting perfectly but it should
be cookies.
Maybe we have this this evil device.
So it should be something like cookies.
And here you can see you have sends your password to this another feel and it is not swinging that same.
So if I just hit enter then it would say that you have read it to the congratulation page.
So just remember anything that starts with this question mark is your barometer in the upcoming.
So where will this haunt for the Axis attack.
You will see how this barometer will be vulnerable and will just index some of the payload in this perimeter
to see if the websites have they accesses attack or not.
So this is our first challenge and with this parcel for silence so let's go back over here.
So again we have to this redirect to the javascript mission.
Let me just remove all of this and here the next selling to the simple challenge it is a swing us to
disable the script.
So if you are modular then all you have to do is go to this option and instead of be friends I have
to do config.
So the second week and it will this give these masses and I'll just say I said the ricks source for
Java script and you'll see in the second barometer here is saying that surveys keep dot enabled you
have to toggle this value to false.
So all you have to do is follow this which is modified and if we just go back here and refresh this
base and you didn't disable because.
Okay so first of all you have two disabilities and we have already so known.
If we just close the browser and restart it again it will this go to the congratulation base but I don't
want to do that.
So all I do is this make it true.
You can just tested because this is simple cell and so all you have to do is simply disabling the javascript
which is a pretty funny challenge because this doesn't didn't make any sense but all you have to do
is to know how do this to make use of these surveys.
If you are on a Chrome you can simply search for the Zavos script on this charge panel on the settings
and you can just toggle this value to disable.
So it is simple and funny science.
So next challenge it's a math time Zelin.
So let's take this challenge.
So it is giving us some of the math problem over here.
Let me grab my pen first.
And if you just remember we have this.
Okay.
So first of all I have to make this smaller.
So let me just remove this.
Let me clear this first.
Take my pencil again.
So we have now here very well.
And in this variable What do you have is you have created some of this operation over here so simply
what we did hear was we just created the full variable and we just assigned some variable or some value
to it.
So all you have to do is just simply calculate this value and I guess its value should be something
about for these seven.
So let's take this.
So I think it's 47 so let's go over here.
So I have this to open the calculator and now I'll just pass five plus six plus seven which is basically
simple five plus.
Okay.
So this is not a plus I have to square this five and it is
plus saving OK.
It was into seven okay.
And we get forty seven so forty seven was the operational way up and we get to the forty seven now the
next is the variable which is by the variable and it is going to just do something like forty seven
and it will do the modulo of it.
So what we did just here is we want to divide first forty seven with the eight and get the remainder.
So this modular sign is basically getting the remainder and it uses the system to bar so less means
so you 47 and it should be modular of it.
So what we did here was 47 and first of all you have to divide by it.
Okay.
You create this first 47 modulo and it is it.
Okay.
This this is simply a modular so it is dividing so this would be 47 and divide it.
First of all with eight and you will get something that values five point eighty seven five.
So that means you have to just grab whatever is the remainder.
So remainder here would be seven.
Because if it is to multiply again with it and multiply it by five you'll get 40 and the remainder would
be here.
That is simply seven.
So if you just see here we just divided forty seven which is the value of four.
So here it would be forty seven and forty seven modulo of it would give you seven because forty seven.
Because let me show you forty seven.
And it is divided by it will give you something like five which is basically not a remainder remainder
would be seven and we just store these seven to this bar.
So now bar will have seven.
And now we have the more more more.
So this variable was created with the bar which has the value of seven.
And if we multiplied a seven with two you'll get something like footing.
And the 14 would be to take over here.
So this ADR is something like you can do over here.
So it will be something like 14 divided by three.
If we divide this it will get to the something like three four here the value is for so you'll get the
full weight here.
But this is useless because riot is not doing anything inside this once and all we care is about this
more so your more Fred Lu was 14.
So will this spicier 14.
So what this fun son is doing is it is just taking our password which is the full which is the password
over here and it is taking for that land.
If that land was fourteen it will give the alert.
It will basically how do you handle to this level password with the new password here with the land
of 14.
If the password land is anything other than the land of 14 it will give us a lot of us.
So let me just try.
We are so we do have the Linda for let me take the password.
It will see incorrect password again because it is going over here and now again.
If I just take with the basically 14.
So we have to just take for the 14 and you should have the fortnightly and so I'm just taking form.
So I'm just putting 14 character away here.
Let me just take password and it is saying you have already done the mission because I have already
passed the mission so I have just redirect to this congratulation page.
And if you haven't done this mission or you are doing this for the first time you'll just get the congratulation
base.
So we have now completed this three test in this Celexa in the upcoming lecture will this go with these
some of the easier negative ones stopping so soon the next one.