So let's see the types of the excesses attack.
Which is basically the types of cross site scripting attack.
So we have a bunch of four types over here.
To the goal of the excesses.
Attack is always to execute the malicious zombie script court.
We have already seen some of the examples in the previous lectures.
So there are a few fundamentally different type of its giving that goal which is basically executing
the malicious javascript code.
So he accesses attack are often divided into three types of first one here is persistent accesses.
So this persistence exercise is basically the type of access is where the Melissa uses string ordinates
from the Web site database so you are just getting the access to the Web site database.
So every time you log in to some bids it will be visible or it will be reflected to whole of the user.
It won't be dedicated to a particular user.
All of the user that resist that particular Web site will get affected with these persistent accesses
attached.
So the next one is reflected accesses attacks.
So this is the type of accesses who had the malicious string that means the code ordinates from the
victim records.
So that means it will be only reflected to particular victims.
So whenever anyone opens the infected links or the Udell it will be visible only to that victim and
it won't be effective to whole or broad domain of the users that will visit the Web site.
So in this case in the case of reflected accesses only the particular link will be infected.
So whenever any user will visit that link they will only get infected by their domain or whole friends
of the user who use the Web site will be unaffected.
So we'll just see about this persistent and reflected assesses attack in this lecture.
So another one or here is dorm based access is attack with the vulnerabilities is in the blind side
code rather than the server side code.
So it is similar is of reflected but in this case will this work with the events and some of the door
manipulations so as to the settings there is dismal content of the Web sites.
So in the previous couple of lectures we have illustrated a persistent axis is set.
Now we'll just see how this work with the reflected accesses and dorm based Texas this attack.
So we can just take that example over here.
So what is the particular picture over here where you can see the axis attack.
So first of all in this case the attacker will craft a UL containing a malicious code and it will be
sent to this victim browser.
So attacker will just craft you at all.
That will be infected until you can see here and it will be linked or it will be sent to the victim
browser and the victim is tricked by the attacker into requesting the Udell from the server.
That means you do this asks for the URL to the server.
And this Web site includes the malicious string from the URL in the response so it will just pass.
The response from the server and now in the fourth estate the victims the browser will execute the malicious
script inside the response and it will just send the victim cookies to the attacker server over here
an attacker will just gain access to the victim's credentials.
And this is the way where they access this attack is very harmful it is a simple script and it will
be very dangerous because it will just get some cookies some session of the victim's ways to control
over the victims browser.
So let's see some of the examples of the persistent and reflected the excesses attack in this Celexa
in the test Web sites.
So I have opened this test which said over here which is Test B as beta we are led and Dot web dot com.
And now we can see that we have already seen this part in the left hand side that is search.
Art is wonderful.
So anything you type here will be reflected right over here.
That means you can just inject some of the code over here.
And now what you can see here it is that reflected the accesses.
That means it has been deflected to the SDM content.
It ought to be visible to anyone rather than to this particular computer.
So if you just open the same link in another computer you will see different type of e-mail elements
over here.
So when it does run some as dismal are basically the command way.
So if I just run this you have been hacked then you could see we'll just get to who have been hacked
over here.
And if we just sit on the same.
That is a you had a little bit here.
If you just copy and send it to another computer and it will be visible to this particular you are lonely
so any other person that will this run this particular link will be only affected or infected and the
rest of us who normally visit this website won't be affected.
So that is your normally reflected excesses with the particular user will be only infected if they get
that particular link which is in fact a link or a you at all.
So let's see some of the example of the persistent and we'll just see.
Well with this open let me see we'll just go to your profile and now I'll just give some disturbing
here.
And the next to also test if I just log in with these steps then you could see it has a Johnny Smith
in the corner over here.
So what if I just run this script which is you have been hacked and if I just update this then you could
see we have this.
You have been hacked.
Now let's go to the next private window so let me just open this new window and you could see this is
private window.
That means it is different from this space or it is basically the different user.
So let's go to the same we've said that this disappears.
Beta Vale in that wave.
Let's go to your profile over here.
And if I just spots your test as user name and test as the password so let me just log in.
Then you could see you have been hacked.
Has also prompted in these same browser are basically in and for another user.
So it is reflected accesses it is visible for particular user it is visible to whole domain of user
will just visit this particular site.
So this is the type of access as a tag where you can just give data or give your code to the server
and server really store that particular infected data you need to look to you to all of the browsers
who will just assist that pays.
So here we just submitted our alert masses injected in this space and whenever any user that will visit
this space will get infected.
So we have this get access to the database of a server and we just injected some malicious code to the
database of the server and whenever that any user it can be any user who visit this space will get this
prompt of you have been hacked so this is the type of your persistent accesses attack and we have seen
aboard the reflected exercise attack a couple of times in the previous Lexus so let me show you one
more time so and I just go to the home.
And let me just place on this sensitive perimeter and let this place stick.
Now let me just go to link to then you could see we have here too bad image I have a lady seal on you
that whenever you get anything with the question mark is your barometer.
So we have bee as a barometer and BP is a barometer.
So I'll just index this simple script over here saying alert so I'll just pass here.
Alert of let me see one and if I just close my script now when I just execute this and let me so use
something that we just get one.
So this P bad it is one devil and we have injected our script called away.
That is simple payload to this to one level to see this barometer infected.
So this perimeter has been infected.
That means it has the excesses that explode in this case.
We have now deflected access is set attack so anyone who will visit this particular link so if I just
copy this and give this link to any other user so let me just run again the new private window.
And now when it just give the same link and if this new user will just run this link then he will also
get infected.
So this is the type of reflected the accesses attack.
So it ought to be executed to the whole domain.
Instead it will be only executed on the victim computers who will execute this.
You are.
So this is the type of reflected the excesses attack and it is really important.
We'll see some of these excesses attack in the language site in the upcoming lectures and this is the
two types and the important types one is the reflected and then there is a persistent persistent is
the way to this inject the Malaysia scored into their database of the server where we can see that any
user that will visit that particular page will get infected.
But in the case of the reflected excesses attack only the particular user who will get that particular
link will get infected and not all the user will get infected.
So these are the two types and important time.
So assuming the next one where will just learn about more of the axis attack soon the next one.