Now let's take the Noda challenge which is our skip Selin.
So let's see how this is.
So first of all as always let's see the page source pressing control you control the for finding our
check which is take pass all the way here which is the button and this is also going to call the SEC
method is useful.
So let's see this SEC meter now.
So where is our tech meter which is over here.
So once an e same as the meter.
So this function is going to the SEC for the X.
So if the X is equal to more so let's see what is more.
So more is just a wrap here.
So what is it is doing is it is just calling this an escape method again with these bundles of a character
over here.
So if we just grab this character let me just control C go back to this hack this site and if I just
press control v list take the password not try again.
So that means that this is not a valid.
It is basically encoded in the form so that the browser on and give you this basically the way to this
to go inside the system.
That means it is this encoding here.
So it is the way to this in court some of the characters in this table so that the password will be
hidden or basically the SS to the system would be difficult for the hackers.
So this is the way we do this to make or encode your character in this demo.
So let's see how to decode this.
So if I this go to this Web site of literally scores and see over here we have a bunch of a new URL
encoding over here and you could see we have different character encoding in the use of it.
And basically it is different for uppercase and it is also different for the lowercase.
So if I see here I have the I in the lower case which have that is person day sixty nine is a use of
it.
Character encoding inestimable.
And if I see over here the first character is encoded is.
Percent is sixty nine.
That means if I just go by here it is I into a small.
That is person to 69.
That means the first character of our password would be I listed another one.
And it is person to succeed.
So if I just go here and the source four percent is 60 you could see right over here which is percentage
60 saying yellow.
So next one would be ill.
And again you could see simply that it is percentage 6.
So it should be right over here which is a small.
Oh so your suitcase.
Now it should be something like I love.
So if I just go This is the boring way so let's see some of the funds to it.
So let's go over here and what we want to take is the value of the more.
So if you just get the value of the more you will just get all of the character.
So let's go over here and on the console in this space so others go to the Inspect Element and on the
console.
And as this one the more let's see the more and it is giving us these values which is I love more.
This must be our password.
So let's go over here.
Let's base these a lot more.
Let's take the password.
So that what it means that means we have just got our password which was encoded in this demo format
and you can just get all of these from here too.
But instead of doing that we just get from the console which is basically getting our javascript injection
or basically getting our javascript variable from the basically the console.
So we have just scored our escape silence successfully let's see another challenge.
Let's take this Google away challenge.
So it is also similar as before.
Let's see the base source controller for sake password and now is quite different.
So as always we have the tech password and it is not calling our SEC method it's useful.
It is taking for the sake boss.
So whatever you this right in this field will be just called with the tech pass.
Basically what we have done here is this file is going to take your password and that password will
be just take given as a argument to this take pass method holistic.
But this take pass matter.
So while the city bus so take bus is not here.
So take bus is not inside this document.
If we see we have only the check.
So this method is not going to be executed when we just pass these valuable here.
And if you see here it has another method which is take bus.
But in this case it has doubled that.
That means this is not the same matter is take bus all we want is take bus method which is not over
here.
But if we just see here we have the next escape.
So let me just grab this tag first of all let me just copy and go here in my sublime.
Let me just pasted down here.
So this is the way to inject the external Jesus file to this document.
So if this see here it has a type which is obviously the javascript type and the source attribute.
So we have already started that if you want to inject this cleared from the another file which is not
inside this same document you can just give this attribute as CSR C and provide the part way that you
have the take pass are basically where do you have the javascript file.
So in this case we have the SEC pass a dart this file inside this link.
So let me press this and you could simply see Sec pass method has been hidden inside that link.
It was not inside these parts basically inside here.
It was basically given as a link in the Assads attribute to make hidden from the weaknesses for the
user.
So that means take pass has been hidden inside the link.
Let's see what this took place it does it will this take the pass which is our password.
It would just take for this.
So let me just copy this go over here.
Best is so this suitable password.
So let's take first for the draw which is basically if we see it has the value of more so it should
be more.
And this thing is just giving us this space.
So that means it should have a space optimal and we have the value of more is b w units over here.
So it should be Peter Leon.
So this should be our password.
So let's see if this is the password or not.
So let me just pissed you down here and press the tick password and it is saying the goods up.
So that means we have successfully done the next mission.
That means we are over here.
We just completed our Google away challenge so we have now next to moderate challenge which is important
tellings until now so this will be covered in the upcoming see in the next one.