So we have completed the three challenges.
Now let's take these four challenges.
So as usual the Space Control you are see the source score controller for seeking the password.
So you are just getting this button again and it is going to this call list Jake Franson with anything
you write on that field which is and this field over here.
So now what you gonna do is just search for the tech funds and which is right over here.
So here what is going have meaning are what is going over here.
So let's say this.
So let me just control C and let me just go over here and left click on the console.
So the C Inspect Element first and on the console let me just clear this real quick let me just based
this down.
It is going to set me up for the zero.
That means it is doing nothing it is just taking one string within this thing.
So if you just see here double equal ease for equal to it is not assigning it is just taking you.
This is string musical to this is string which is obviously not because this is had this side and this
is the content with another are basically all.
And another thing which is are not these had this side if it was something like heck this side call
had this side.
Let me just say that this is hack.
Are this site.
It is going to give us that is true because this is string musical to this string.
What here.
It is not true because this string is obviously not equal to that string so this doesn't make any sense
so this was doing nothing over here.
All the interest is in this if condition which as our password because we despise anything you write
about here is a exe to this funds and sick.
So our first word has been sick with this part.
So let's see what is this.
So if I just copy this and this go right here then you could see now we have something that this double
chord.
So let me just make this as a string too.
So instead of this idea though LA which is obviously the variable in this case.
But I want to just make this easy string.
So I was put here.
Double chord.
And if I just sit into it is going to give us the idea of what editable lower because this part in the
beginning and in the end is basically empty.
That means all we count is over here is I have this to manageability this variable is this string but
here it is this string are basically these are variable.
So added blood added of Lua is a variable not a string.
So all we want to this take is only this variable what is the content of this variable because anything
over here which is concatenate at the beginning and at the end is only the empty.
That means will only take for the variable RWA RWA.
So if we just get the values of added value add in our dollar will get these masses the ways it was
the same.
Now try again.
So let's do something like opium poppy Harlow so we'll be in the C or not try again which was basically
calling this as part heel.
So I want to just get the content of forehead of lower our dollar which is let's see where it is.
So this seam should be the source for this.
So as I say I don't.
Low are already.
It is what is here.
OK.
It is just over here in my case what it can be some way for you and for you.
So all you have to do is source for the variable so it was right in the corner right in the right hand
side for my case which is just over here I think they have just made this intentionally so as to just
make the user the basically the hacker not to get easy laces to this more so basically our password
would be more because we have this variable is a more so if I just go back and the sponsor Yum.
Or oh let's take this.
It's to give me alert.
Ah don't worry.
So all you do is you have just made these variable so look so easy with this.
Just taking this matter only to take matter.
This digging for this variable and getting the alert so we can do that and know the method over here.
So all I have to do is inspect the element in this same hide this site.
So I'll just go to the console.
And if it's a C member here all you have to get is the content of added value added not it will work.
So let me just copy this because this is the variable.
Let me just space this down here.
It is going to give us a more.
So I'll just copy this contained.
And as you know we're going to get the correct output over here if we take the password and it is the
same password over here.
So you can also do something like.
Let me say that injection.
So you can just sense the variable content and make your own password over here.
So let me just appraise again to go to this inspect element and go to the console.
And if we just remember here all you have to do is get the content of it already narrow Latin RWA.
So let me just go again and.
OK.
So we are rid of Lua.
This variable.
Let me see is continued more.
So what if you done one.
These are added w are to be mom or dad if you want to say something like go and known the password would
be good.
So let's stick if this is valid or not.
So if I just press here go.
It's just more.
Let me just take password and it is saying I did.
So I'm just passing here.
Go.
And now after users place that and if you just go out of this console to say incorrect password again
because you are just doing the injection to the Derby script to this particular site so this can be
really handy if you just make use of the excesses attack in giving the java script NASD mail injection
to this current document and we learn about this dermal injection and the excesses attack hunting are
basically how to get the exercise attack from the making payload your own payload from using the barb
suit in the upcoming lecture.
So here what we did was we just make a simple javascript injection and we change the original value
of the added value added a blood variable to our own password and we just made the injection which is
known as the java script injection.
So we just completed our VOD so we can this to make use of this escape to go away and obfuscation which
is the important lesson in the upcoming lecture.
So soon the next one.