Hello and welcome to this lecture in this lecture we learn about some advance concept and we'll also
learn about this visit factors how to work with it and some update bonds below that can be created with
itself a script called so you can see right here that we have to guard these six assists you sit you
can Kansas get this link from the description and now you can see all of these event based takes this
is and it has description it has to it so you can see the resource based here and there you'll see how
these so works.
So we have.
Yes visa unload right over here which is saying that a stable context tag injection will see how to
use this as fizzy vectors in the payload you can see the on most over you can see all of these payload
over here so you can just go one by one or you can simply go through the selector.
So in this elixir we'll see how to make that one spilled with these websites.
So we'll see these tapes to site over here.
You can simply go to this prompt dot e-mail and go to this zero here which is the first challenge.
So let's get it started.
So first of all let's get some input.
So let me set some input over here so say hello.
So Hilo has been reflected in the value so you know how to now create the pillars ways to run your payload.
So first of all you have two closer values.
After that you can just open your script.
So let me just open my script.
I a lot.
Give me the masses are this close my script.
Then you could see there is a prompt.
That means we can go to them.
Challenge one.
So let's see in this challenge you can see the funds and that is going to be executed.
And you should have guessed that this will just take the input and it will just replace or strip this
part so let's see what is happening over here.
So we wanted to say hello.
So Hitler has been reflected inside this article which was our input right here inside this article
that but when I just say something like this script and close this script then this script will be invisible
inside this article.
That means there is something to do with this script so there will be something if I just made the mistake
and if I close this image it will be invisible over here.
So that means we need to do something in order to make this visible.
And here comes this yes visa on Lord method.
It is very important so you can go to this to see it and see that we have something that eases visa
and should be unloaded matter so unloaded is basically going to be the event which will be triggered
when all objects will be loaded so all we can do is go over the top over here to see for this visa and
you can see this method right over here so you can just go over here and just basically down.
So we want to just execute this so as this would the calling routine.
So yes visa is the vector here and the unload will be called when the object is loaded.
And when I just say this visa alert then you could see we have successfully loaded.
So let me this go to do now and now let me say hello again.
So text has been encoded here so let me just run my script.
So this is script.
So it is visible over here.
If I say alert and 1 and if I thus write script again then you could see that this opening parenthesis
has been invisible over here.
So it has been just invisible that means we need to do something in coding so as to give these Batten
disease.
So here you can see this escape method has been called in this input whatever input it has any to this
replace this opening parenthesis with empty string.
That means we need to encode this opening back into this.
So I have this website here.
That is a way of encoding utility.
So for the opening parenthesis you have this encoding.
So let me just take all of this and score over here and this best date instead of this opening band
is this.
But you could see that instead of just executing the alert or the masses it has reflected the plain
masses over here.
So if it is the case that you get the plain masses then you have to use this visit vector so you could
see that when this type here is busy it has got as a prompt so you would wonder why this.
Yes visa has been used so I got some important information on land here in this tech sense.
So this is pretty much what it explains aboard the U.S. visa Victor.
So you could see that the script that has this see that element.
So that means this any feel which is this opening that is angular bracket at the rate.
And basically this and the character everything has been encoded.
Basically you can see this is the encoded form in this script but in the case of where is Veasey which
is the script in this SBC is basically they examine Tom's.
That means the element yes visa is script is this s visit nemesis.
That means the SBC is script element is the namespace which are different element that means it does
not need to be encoded so everything over here was a plain text if it was not is Veasey but the SBC
will not do encoding it will simply put.
Same as here.
So if I just pass this that is opening pan this is it on the past or it or and get encoded it will simply
remain the opening pattern this is because the concept of C that element is only in the s CML world
that this festival dismal has developed so you must remember that one thing if plaintext has been the
output then you need to just pass.
Yes visa which is our Victor if if plaintext has been reflected in the source that you can see here
in this dismal source it has the plaintext over here.
In that case it should be is Visa Victor because in this busy world this encoding is simply not done.
That means it won't be passed.
It will remain the opening parenthesis.
So we have this successfully made to the execution of them two settings to let's go to the cell in three.
So we have now the challenge three let's see what it happens over here.
So when as I say hello.
So and as a law it has been reflected in this part it is in Hello.
And it is inside this comment.
So you could simply see we have written everything and it was inside this.
Basically what to say this is the comment in this table.
So first of all we have to close this comment.
So for that I have to first of all close this comment.
And when I was in court there when I just see something that when I tried to close this then it has
been replaced with underscore you can simply see over here.
So we need to this close or this break over this comment with this closing.
So we are now out of this comment.
So after that instead of hello we have to open again this visit Victor.
We'd unload so unload is basically a event that is going to be triggered when all object is loaded.
That means this SBC is the victor that will just see this information if you want to get more knowledge
about this visit Victor.
But it is simply going to be called when there is a plain text.
So if they estimate a source is suing the plaintext.
You need to this past this visit Victor and under unload.
I can simply prompt or you can also pass the alert masses and you'll say you win over here.
You won.
So this cannot be the masses over here.
So next one is the fourth challenge.
So here I am.
This is some of the matters right here.
So it is going to just get the sample script so whatever with this pass him.
So let me just pass instead of this test is this.
I'll just pass this month's link and let's see what is happening over here.
It is a simple challenge by the way.
So let me this based down here so it is showing that the link is injected inside this society.
So if you remember we have learned about this in the Salvos script basic section Well this is RC was
to Lord the external javascript.
So if you thus get all of this link and list pasted down here then you will see that this this is LAUDER
So this is the way to Lord the external file to this current document with this link over here.
Inside this RSA attribute.
So listen for this silence five.
So let's do something over here.
So I want to say hello.
So when I say hello.
It has been reflected in the field.
So this is the way where see something is inside this value field.
So if a this make my simple payload which is my script.
And if I just stay alert and 1 and again close my script.
Then you could see something's happening over here.
This bail order anything that you write in this field has inserted inside this value is string so it
is reflected inside.
This is string.
So first of all we have two genes is type.
So I'll just make gross first for this value feel now value field has been closed up to that I want
to put another external value.
And after that I want to put externally to the warrior which is the type.
And if you remember this type is the attribute of this input field.
So I want to give the type I want to see the is I want to see images because we want to make use of
image is fairly low.
And we see something like on either.
So on either is the event which is going to be lowered when the there is no team is found in this artsy
so.
In this case I want to lord these prompt or you can also see the alert masses and so on.
So what happened here is basically we created the type image which is here.
And let me just set into it is not executed because the type has been her image and on this RC and it
should be on either it will get the prompt of one.
So what happened here was we just didn't get maybe this one so you can see the prompter over here.
That is you 1.
So what we just did here was we just tends to type from the text to the image and in the images attribute
we have them.
Even that is on neater.
So this will be triggered when this image is full on to get any.
Yes I see.
So here is our season empty.
That means this on either will be triggered which will give us a prompt of one and you can see you on
over here.
So let's go for another challenge here.
So it's just that for this you can also make other certain versions so you can also make you use up
on resize attribute and this can be made from of one and missed into again it is not working OK.
We see on three sites
you see on
the sea on input
must work but on input and the school here and the prompt of one it must store book.
It is not working so let's to stick to the basics.
So yeah we are just getting the prom from the e-mails because we want to teens from these sticks to
the type which will be emits which is simply doing.
First of all will this close our value and will Justine's our type 2 e-mails.
And yes our C because in his day had this RC and on either which will be triggered when there is the
either in the inmates then it will this prompt me one then you can see you on over here.
You can also say alert instead of one prompt and you will see the alert box over here.
So let's go for the Talon 6
so we have long escaped method over here.
So let's see what it is doing.
So instead of just see what it is doing this.
Go and see hello over here.
So it is saying invalid data.
So this falling would do something like a reed Erickson let me see came.
So it is saying for B Zabriskie place do something like that by script which is the way to indicate
some prompt.
So I'll just say prompt prompt is basically the alert in one.
And let me see.
Yes.
And give the axons.
So in order to give the axons let's make use of this curly braces and this action should be okay.
This X and these they attribute over here and I'll just pass through to the section then it will source
that is you on.
So what we did over here was dumb gloating so dumb clobbering Kenny straight in the very situation so
it is the way to interact or inflames our website is.
So we just made a use of for dumb clobbering to interact with the websites.
So it is very much problematic and there is two groups of attribute we can see.
We have the name here and basically name attributes and we also have the the idea attributes depending
on which estimate they are being used to with an attacker can override this property disable the funds
and so in here we made the excellence to be enabled.
So depending on who is this team.
And now disable or enable and influence the javascript logic.
So based way to this to get around is not to allow this a name or the expense I.D. attribute in the
user control list dismal content.
In this case we made the use of this expense attribute to be just replaced with this prompt.
So that means we just made a use of dumb globally.
We just assess the elements of this dismal to just inject our own code of this prompt.
So this will be a wrap for this lecture we'll just continue with upcoming challenges in the upcoming
Lexus in the next one.