So let's continue with some of the remaining challenges in this lecture.
So we're off to this challenge number six.
And now stem to the solved the cell in seven.
So let's see this once and all this once in is doing so it is clearly a device good funds and and it
is saying something like this bus dog yet a bird and mouse.
So if this is possible it is showing up to you more so after your meal.
It is invisible over here.
That means title can only contain dual character.
So this is made in such a way that this title can only take only basically to character.
So if you want to do something like Yes visa which was our visa Victor and unload and if you want to
pass the alert masses of maybe one here.
And if we just closed this it is not valid because if you see here in this title only to unload is loaded.
After that it is invisible.
That means it will only allow dual character.
So this payload is not valid in this context.
So we have to do something else.
So we have given some hints over here.
So if you see if I just pass a dog and if I put has then it is just going to the next line.
So if I just now put the.
So Kat is in the next title and if I just put hexagon and put board then the bodies in the next state
flag means it is in the next line so we can take advantage of this has in order to make our complete
payload so our payload would be yes visa obviously.
And after that you can just pass something like a that this is a normal attribute so you can pass anything
over here.
So I'll just pass that is equal.
And now has because I want the next line to be in the next line because the next part what we just write
here will be in the next line.
So now I'll just pass.
First of all the unload method.
So I'll just say unload and in this unload you have to first of all make the payload first.
And now I have to again make has that is for the next line.
And now I'll just scream prompt or basically you can also give the alert masses and if I disclose this
which was the unload is being closed and now if we just run this if I just sit into nothing is happening
because this part is not prompted that means we have to just make use up escape character to encode
this.
So I'll just put their escape character and basically I have to also put this a strike and the same
over here because this is the way to comment.
So if we just see here it has been commented now that means that this part has been commented because
anything after this unload is useless because we don't want this whole part to be included on billowed
because if I just run my sublime and so you are the pillar look like.
So here our simple payload will be.
Yes Veasey and it would be let's say.
Which would be any attribute and we'll have unloaded method and in this unload you would simply call
your prompt.
So it should be from of one.
So this will be your complete payload.
But if we see here that anything after this the equal sign has to be neglected.
So anything up to this equal sign is this much part.
So this must pass should to be neglected.
The basically what is selected over here.
So this must part should be neglected because this is not the part of the payload.
So we put your comment sign.
You can see here the common sign will just neglect this part and we'll make our complete payload to
be executable.
So again if I just execute this and it is again not working let's see why it is not working because
we have to see where this payload is injected.
So let me just copy this first and remove any let me say first.
Hello.
And let's see where this is reflected.
So as I say control you control live and hello and it is not reflected here.
So let's see where the script is reflected so basically it is reflected over here.
So it is reflected in the title that means that we have to customize our payload because this is busy
vector cannot be included inside this title.
So we have to first close the title.
So in order to close the title you have to first close this title attribute and B class or b attribute
after that.
So this is our prompt or this is our complete payload.
So you can see it is giving us a prompt saying you we are you on.
So we have made this advance payload over here.
So it was basically the simple unload but this title has allowed only the footnote character.
That means we have to this customize the payload.
And you know that the vector should be included outside of the USDA tag.
So we first of all closed the attribute of the title and after we disclosed that we disclosed the B
attribute or b tag of the estimable and we'll just launch our first visit tag or with the vector over
here.
So this is some of the technique in order to this customize your pillar.
So now let's see for the next challenge that is challenge number eight.
So let's see this fonts in here.
It is saying preventing people from getting out of the comment is strip of line break any step so it
is basically replacing some of these characters over here and it is returning the one that is basically
in the single code over here and it is just consoling us in words so let's see.
We have the two challenges to be solved in these levels of resilience would be to use the valid javascript
line separator.
So if we just remember we have something like a line separator that is lesson and it can be also SLAs
are lines separate.
So these are the lines separator that is SLAs are and next one would be SLAs yen.
But if you see here this is not a value so anything you write is a slice and it's less and has been
included into the console log because it is been replaced.
So we need to find the alternative way to comment out our code because commenting with these is basically
inside here.
So we have to now do two challenges.
So first challenges would be to make use of the lines separator by not discord.
Instead you have to make use of other code and the next away is to command out the code.
So let's see how this can be done so if it does have any knowledge about the line separator there is
a duty of code for that.
So for UTI or for the line separator will be you and you have to give plus two or two a.
So this is the line separator code or a character that will return some is basically inside the console.
So let's see how this works.
So if I just spicier you and at least and this two or two eight and if I just close this down for us
well it should be here.
So this is a your your line separator.
So line separator duty of code so you can simply inject something like So let me show you a quick example
here.
So if I just make a script and now if I say that console and dart log and here I'll this prom
me one and close this and after you this close this one and close your script so you could see something
happening over here.
So it has replaced some of the characters like a line in space and something like that.
But you can see the console log is just printed out here.
So we have to make use of the challenges that is to make use of a day of coding or basically the line
separator so let's make our tool are basically 14 lend character payload over here.
So first of all you have to give your line separator which is discord.
After that you have to make use of the prompt and give the one.
And again you have to disclose these lines separately because we want something out of these parts so
to aid that is simple over here.
So we made use of this.
Now if you just see this is inside the comments so we have to first of all close the comments including
the comment in a stimulus with this code.
If I hit enter now.
So it is not working maybe we have made OK.
Let me see.
It is in the console log.
Let me just make this alert and see what happens.
So it is not working.
Okay.
This is.
Let me put here in let's see.
And again it is not working so maybe
this put this commenting on let's see.
And this is not working.
Maybe due to the line separator or the browser incompatibility so let's get rid of this unless you for
selling the same.
So we'll just work with that in the later section.
So here we just pass.
Hello and it was reflected right.
This is script.
That means and this is LNG.
So if I just give something like prompt and no one then it is saying OK you are getting this.
So that means it is inside here.
So what is very right here was a reflector right at the middle of the script.
So we'll work with the other challenges in the upcoming laser but you can also go through this link
which is the github link over here so you will get access to this link in the resource sector and you
can just take this out and you can get the description everything about the existence vector that just
makes your users give this a go because these challenges are really advanced challenges.
And if you have the documentation like this which has the levels information code and the solutions
and it has also the background info which is very useful so make sure you go through it and you'll see
everything the solution over here.
Even though he didn't challenges so you can just take this out and I'll just see you in the next one.