Now let's talk about the excesses stack.
So in this couple of lectures or in this whole section we'll just talk about the cross site scripting
how it works on the live Web site.
Was it a type of excesses and how do this crack and how to get safe or basically how to prevent from
these type of attacks.
So first of all exercise is a type by injection.
That is a savage record in which attacker index data.
So data here means some type of code or a malicious script into contained so contained here is the estimable
elements from otherwise trusted which.
That means in any trusted Web sites attacker can inject It's a malicious code into the estimable elements
so that it will be executed on the client.
So just remember it is not executing in the sidebar so it is only getting the SS are a control over
the line the machine so cross site scripting attack happens when the untrusted source is allowed to
inject is on call into a web application that means it is the loophole upon ADP poisoning that means
anything in the way is trusted.
So when you just inject some malicious code to the web application it is allowed to inject that caught
in the malicious code is included with the dynamic content delivered to the victim browser.
That means it is talking about that is stored a accesses attack that means it will be referred to the
IS STORED accesses and it will just see the types of accesses attacks in the upcoming lecture.
But for now just remember that exercise is executed to the victims of browser so as to take the control
over its browser.
So the next one is the malicious script are often delivered in the form of a bits of a zombie course.
So that means a javascript called will be injected is a malicious code in to the victims of browser
and it will be exploited with the executable code.
In many other languages that means it will run or it will execute with the Java because java is back
in languages and the java script is a front in language that means there is a relation between the printing
and a backend so fronting is used to deliver the content of the back end.
So that means it will just make use of other programming languages to just inject that malicious executable
code into the victim's browser.
So it will just incorporate with the Java Ajax flex and then stay email which is basically the elements
that will be useful to source some of the content of the web is to the browsers declined or basically
to the browsers so gross cross-eyed scripting or text can be very serious about mitigating the vulnerabilities
that enable such attack is relatively easy.
So that means it can be very dangerous.
What we can do is to apply some of the encoding techniques some of the obfuscates and technique.
So in order to just give the hacker that is that tough time to attack for that barometers.
So that means cross site scripting allows an attacker to execute the malicious grieved as we have already
seen and the attacker does not attack the victims the directory rather the attacker exploits the vulnerabilities
in the Web site the victim visits and gets the website to deliver the malicious script for the attackers.
So it will just index some of the malicious code to the victims basically to the parameters of the Web
site.
So that means that particularly you at all will be only one level and will just make use of some post
basically some delivery techniques ways to get that you handle click to by the users and the user will
think that the at is the alleged Web site but that will be wonderful and the hacker will get access
of the victims the browser or victim's computer so excesses can be used in the number of ways to cause
the serious problem.
The traditional use of the excesses enables the attacker to steal the session cookies and we'll see
about the session cookies in the upcoming lecture and that will allow the attacker to pretend to be
the victim not a user.
That means they will just log into the credentials with their credentials because there has the access
to those cookies other to the sessions of the victims browser.
But it is not just stealing the cookies that hackers can use the access is to spread the malware deface
Web site great havoc on the social web site phishing basically phishing is the way to this grab the
credentials in condoms and with the social injecting technique and it will just cause more attacks which
will lead to making the reversal and just getting hacked are basically a skill index and then everything's
that come with the Axis attack and basically this is a simple way to do this again the essence of the
victims browser but it can lead to some dangerous attack that can just get a sense of the servers with
the axial injection.
Get the information that is critical of the server with these simple attacks so exercise is very important
attack and you can see the simple pixel what he is saying.
What is the plus side scripting so you can see the attacker in the left hand side and the victims or
the browser which is the user in the right inside.
So attacker index the website with the MLSE is group that will execute in the user browser.
That means it will this index some of the payload into the website so that the website will just be
executed on the Web site the user and you can see the malicious script is activated in each CVG to the
website.
That means the particular URL will be infected and whenever the malicious script is activated it will
be executed on that machine.
So under particular Muhsin will be executed not on hold much.
Just remember that that cross site scripting is basically infected.
R is going to infect on a particular view at all so anyone will just visit that you at all will get
infected not all the user.
So after that in some attacks the victim cookies are stolen are private credentials can also be revealed
by the attacker by getting the SS to the victim's computer.
So this is the way how the cross site scripting works.
So we'll see how to make the payload.
How to see how do this to work with the cross site scripting how to make actual payload and inject in
the light which sites in the upcoming lecture.
So is this one of the way to this to make the code and run so that we just get some big bounty so bug
bounty and basically bug bounty is our platform for just the attacker to the stipend in testing and
just to reveal some of the attacks that can be this to use to test the waves there.
So that means anyone who will attack to their website will just report that this new URL is infected
and they will just be rewarded with the prize in Hall of Fame.
So we'll see about the crash site scripting in the upcoming lecture soon.
Next on.