Welcome to dyslexia.
The couple of lectures from here now will be interesting because we learn how to make it a fun spell
or do the help of JavaScript in couple of lectures.
So here is the test Web site so you'll just get these test to Sage from the description from the resource
section so make sure to grab that.
So let me just click for the challenges so you can see it is saying in the name here.
So let me say something like the sets in which is my name.
So let me just search so you could see something has been reflected right here.
So let's see the source so you can simply press control you to see the source.
So list serves for certain because we have this board the setting over here.
So let's see where the sets in is reflected so you could see it has been deflected just over here.
So there is no way except here that this has reflected.
So what you need to do now is first of all you have to make a payload in such a way that you have to
inject your javascript code so let's go here and inject some of the court so you could also see over
here that this field has been injected in this name.
So let's try our simple payload and let's see how this works.
So this is a challenge one.
So let me just make a simple script and it will say alert and document dot the url.
So it is basically fitting the URL.
And let me just close my script.
So let me just grab all of this script and let's see if that parameter is vulnerable or not.
Because you could see the name has been deflected right here.
That means there must be the accesses vulnerabilities in this field.
OK.
So let me just grab this one.
Let me paste diet here and let me just seed into then it will say good work.
You are welcome to the next round so you cannot support the same is here that we just did in case of
such and you cannot support the same.
That is below what we just created right here over here.
So let me just paste it down here and search.
So you are also getting the same good work a dialog box over here.
So let's see for the talents too.
So let's put something over here sir that will be deflected.
So as this but again this sits in the same setting and it is saying that it cannot find the query so
that means it has not been deflected.
So let's see if this name feel is also wonderful or not.
So let me paste the same you URL that we just created that these documents are due out.
Let me just seed into and it is not getting done.
Basically what we see the matches that are dialog box that means that this link or basically this script
has not been executed.
So let's put again the search in that these same text lists search this search in and let's see where
this has been reflected.
Let me press control you for your source code and it me source now for certain and it has been deflected.
You could see it has been this indicating this value of search in so let me just grab hold of these
from here.
That is from input tag.
Let me copy this.
Go back to my sublime and this is your silence to let me this bastard down here so you could see anything
you type is indicating this value.
So first of all if you want to this insect some of the Japanese Good Good You have to first close your
input and because this is a similar element so you cannot do something like injecting your script which
is the java script and giving the alert of one or anything and thus making the script close here.
So you can't do this because you are inside these input tag which is your race team element so you cannot
inject your script inside this is de element.
So you have to first close this system element and then you can inject your code.
So this part is invalid so you can do this.
So now we have to just make our own payload in this case.
I have to first close the input tag so you could see in order to close the input tag you can simply
give these clues Angeli angle bracket and after that you can just run the risk which can be the same
over here.
So let me just grab this whole up this link and this is basically this fitting or this giving the script.
So this is our payload for silence too.
So let me just copy this and go back to the practice lab.
Let me just basted and let's see if this works or not.
It masseurs and it is also saying good work.
You are welcome to the next drone because this payload has been to work so let's see if that's talons
tree.
I'll just say hello.
Okay.
Hello.
And let me hit certs so same as before.
It has not been reflected Lissy for this parameter name and less indexed to your gourd.
That is the script and let me hit enter.
And again it has not been reflected.
So again let me just go back to those in endless.
This one control you to see the base source control live and source for setting where it has been replaced
so it has been reflected in this value field.
So same as before we have to just make our own payload again.
So let me just copy this and go to Sublime.
So this is your three.
So what you get here is this fail.
So if we see here we have already said before that you have to first clauses stimulus elements in order
to inject your script.
So here it can be something like this so in before so we had this payload.
Let me just copy this and let me just pressed it right down here.
So if we just do this one it won't be valid because you have to also close a d value field because anything
you would here is in the script will be executed right here.
So what if I just make use of a script instead of the settings or what if I just put every script and
alert and something like one and close my script.
So if we just do that it will be injected in the value field.
So in order to just make a script outside of this input that you have to first close this fellow with
this double chord with this double chord or basically a single double chord here.
And after that you have to close your input at like this.
So these two part will close our input tag forced to Belfry or attribute.
And after that it will close your input.
After that you can just make use of your script and anything up to that script to be executed in.
We don't care about this.
We only care about our script so anything beyond that we need not to close are we need not to do anything.
So this is our new build.
So let's grab this.
Let me just copy.
Go back and let's see if this works or not.
So let me this piece to real quick over here that is serves and it is saying good word.
Welcome to the next one.
So here in the silence for me so I'll just pass my name.
Let me see it.
Sir's sensibility is not seeing any reflection in the page.
So let me just say.
Control you and you could see it has been injected in this value field again.
So we have to make our own payload from here.
Let me copy this.
And this is your selling the number four.
Let me just sit here.
So we have to make our own payload as before.
So first of all you have to inject the risk.
So any script will be injected in this valve.
You can see we have just Stipe sitting in that field and it has been injected in this fellow that means
first we have to load your value deg.
So closing will be only a single quarter over here because here we had the double cord.
But in this case value has only the single cord.
So first of all I will disclose our value we'll close our input field and open our script.
So it would be a script and I'll just put the alert document dot you are real.
After that I'll disclose my script and anything after that.
We just really don't care we just want to execute our script.
So will this make this payload.
Let me copy this.
Go back here.
Let me piece to real quick here.
Let me see saws again is the same.
Good work.
Now let's see for the talons 5 and let's see what they have got.
So I'll just say him let me certs and wait for a moment.
It is not loading.
Let me rephrase again.
Okay let me say hey and as usual it is not reflected.
Control you control live and I'll search for here and let's see it has been deflected right here in
the source string so you could see we have little scenes here.
So we are now inside this escape and it is reflected in the variable of tons of ice cube.
So that is strains.
So first of all I'll just take everything over here so I'll just copy this.
Okay copy.
Go back in.
This must be Italians 5 best.
So this is our.
The field way out of here has been deflected.
That means our script will also be reflected in this variable of this of a script.
So now what our payload must be.
Let's think about that.
So over here what do we have is we have something like this so first of all we have to now close our
script because we want this script to be close over here.
So in here we want to close that script.
And after we close we'll just sit on our script.
So let's see how this work.
So I'll just go right here and I'll first close my script.
It should be script.
And after I close my script I will again execute my new script with the alert document that you Earl.
And after that I'll just execute the closing tag of the script.
Let's see if this works or if you are confused over here.
So first we just did was we just put our script to that right here.
So we'll execute our closing script that means this part of script will be executed.
And after that we'll just give simple alert to the window.
So let's see what this will do.
So let me just based it down let Zeus and the same.
That is resolved.
Good work.
That's it for the Talon 6.
So let's put something else here.
Let me see cricket at my source.
So it's useful cricket has not been deflected.
If you inject something over here in the name also that is scraped it won't be reflected.
We have to simply brace control you.
And now I just find cricket because I have this source for it.
So this has been reflected again in the variable of the script.
So now what you can do is simply grab this script says grab this copy go over here.
This is the indistinct Zeppelins.
Number six.
So let's see what this bill will be.
So you could see we have the variable created over here.
So first of all I'll disclose my cricket are basically the script.
And after that you can disclosure a script that means that this part will be now.
Let me just copy.
So instead of cricket I have to the sport.
Now this too.
So that means the empty variable has been created first.
After that I'll just run my script.
So first of all I disclosed this script because I will have to disclose this part should we script.
And now I like to use my own script.
So it should be its script.
And here as the alert.
And it will have document dot you Earl.
And this is our new payload.
So you could see what is this dude over here was this made a empty variable with this quotation and
the semicolon.
After that we just execute our basically this payload from here.
But if we put that we have to close this script tag also because it's script tag gone to have to script
tag because if you work with the opening script tag it must be close.
So we have closed this script tag and we have executed our only scripted tag.
So you can also do something like for us to close directly this script act like we have just did here
but this is the better way.
So let me just copy this go back here.
Let's see if this works or not set and pasted and it will say good work again the same dialog box.
Let's go for it.
7.
So I'll just pass here for the while.
Let me source it easily to won't be reflected.
Let's pause for football where it has been duplicated so it has been reflected in this fallow field.
So let's see how we can the script so that it will be executed right over here.
So it could see that it has been deflected in the football field.
Now you could simply see that our value has been as a football.
So let's see how this works.
That is our script.
So let me just put here and document or do you.
Let me just press sirs.
Let me see.
Controlling you to see the base source and you could see that anything you is typed over here has been
converted into this string.
So that is the string.
So what we have done here was we just gave the simple input in that field simply here which was the
script.
But it has been converted to the string.
So if I just gave the simple alert I'm just making a simple build over here which is of script alert
one any script.
Let me search it again.
Let me this press control you to see the base source again that script has been converted into this
string in this value field.
So anything you this past in that field has been converted into a string by this space.
So if that is the case.
So we have just taken the example where you Kansas give the input from the keyboard so you could just
see here we just pass anything from the keyboard has been converted into this string.
So if that is the case then you can just give the input from the mouse and we have learned about the
event in the Java Script is we in the previous Lichter if you remember we have learned about on most
over on most out on key down in every vein that that is related to the mouse and keyboard.
So in this case anything you just type from the keyboard has been converted into this string.
But if we just strive for the mouse that even that can be given by the mouse then it will be visible
over here outside this value.
So let's try on that.
So we have to make our advance build here with the some even.
So this is the cell in seven.
And in this case what happened is we gave input from keyboard to the field and that input that input
has been converted to string by browser or by the server.
So if this is the case then you can give the input from the mouse.
So let's see how we Kansas to do that.
So I'll just give the input from the mouse now.
So first of all you have to this if you see and if you just go back to the base source then you could
see that we have the closing field right here.
So that means we have to give first the single code and after that we'll just make some even so in my
case I let's make something like on my silver.
You can also make use of en mouse out and you can just give this equal in order to just assign some
value to it.
And after that I want to execute some of the messages so that should be document dot you are.
So this is your final payload so you can just execute this payload.
Now let's see if this works or not.
So I'll just go right here and let's see if this works or not.
Let's copy this to this field.
Let me just paste it here.
Let me just SaaS.
So what we just did here was we make use of on mouse over.
So how that works whenever we just move this mouse to their source button it will just inject our Derby
script called.
Let's see if this works or not.
So if I just hope this mouse to their source.
OK.
Okay.
So working in because it was on mouse over that means whenever we just make changes from this to NATO
if we just make cover to the source and again go back to let me go back to telling seven again and if
I just go to the source and go out of that source then it will be executed at least get that same payload
again.
Let me just copy this let me just pasted down here so you could see that it is saying good work because
that gourd has been injected so you can see that when you just replay that to that base and when you
just gave the mouse hover Bjorn that button then you could see that base will be intact.
So let me just score to the challenge a real quick so it is the same as the cell in seven.
So let's see if this works in order in the same manner.
So I'll just see cricket again.
Let me search.
Let me press control to see the source.
And basically these holes are the same talons because the cricket has been injected here so let's see
the script.
So I'll just make a simple script and I'll see a third one and if I just search this let me express
control you to see the base source.
So now you could see it has been injected in this script again but in this case it has been encoded
so you could see that in this case it has been encoded into something that is less than a reality.
JT So here reality is basically encoded for the opening angular brackets so something like this.
Let me show you.
So this closing Beckett has been in court it is a ulti and this has been in court it is duty so greater
than analyst than has been.
It has been encoded and it has been converted into this string.
That means our script has not been executed.
So if you see that input from the keyboard has been converted into something that is encoded form or
something into the string form like in that cell in seven we can make use of the mouse event.
So in this spellings age 2 you can make use of the mouse.
Even so here we can make use of the mouse so you can see it has been duplicated right here so I'll just
make more use of on mouse over billboard or the event so you can also make use of one mouse out.
And now we can just give alert masses saying document dot your URL.
This will be your final payload.
And let me just grab this copy this from here.
Let me go to this challenge.
Let me paste.
OK.
So what we need to do is simply pasted here.
So as this starts so same as before we have to now hobo our mouse to the search button and when I just
make that mouse to go out of their swords button our payload will be executed.
So let's see.
So I am on the search.
So let me make my mouse out of desserts OK.
These are not executing.
And if you guess what with this database so let me this press control you two so you what is going on
here.
So again this field has been encoded so you can see it has been it is caught.
So we just parts here the double coordinate has been encoded.
Is this LRAD or basically end and Gore and you can see on most of the radio.
So it has been encoded that means this Phil is not wonderful.
So we cannot do anything to execute our payload in this field but this is the challenge and there must
be a way to inject these payload.
So let's see anything we just passed over here so you can see this spill or do just on Mosul where has
it been injected into this name period.
So let me just grab this link and let me just go here and if I just paste down here is.
And based it so you could see we have to fill over here one with the name perimeter and another has
some meat.
So you could see that anything that starts with the question mark is a field so we have a name feel
and we have named Phil and it has indicated our.
So anything you this past or in this field is inserted into the name but this name is not wonderful
but we have some may do we have not said this summit let's see for the summit.
Now let's go.
And let me just pass here something like first of all again and let's see if this works or not.
So if I just pass for a while so let's see what it has done here.
So it is a sparse football.
It has deflected in these Barton.
So what we just talked about the excesses was if anything that we passed in the you are is reflected
in the way.
There is a probable sons of the excesses attack so you could see we just pass this football to these
some midfield and it has been deflected to the button that means it has been deflated to the weight
base that means these feel are this summit perimeter is wonderful but this perimeter big no name perimeter
is not wonderful that has the encoding format over here.
Anything you pass is encoded with here that is in the case of the name perimeter but we can see that
some has on the reflected excesses right in the button so let's see if this works or not.
So let me just inject the same payload that we did we just made over here which was this on mouse over.
So let me just copy this and instead of football let me just base this on mouse over now to let me just
hit into so you can see we have this safeguard the button that is going listen so let me just pass put
here so you could see it is saying good work you had a welcome to the next.
So we have just made the summit button to inject or to execute our payload which was on mouse over payload
so what this bill does is pretty much between this get executed the You are all basically what we have
the payload over here when the mouse is hover to that button so when there is a school here it has been
deflected so we have just completed all of the chapters of the cell and so we have just made some of
the advanced and simple payload in these selectors.
So first of all we could see that we have to make our script like this outside of yes de metal tag.
So first of all we have to disclose their symbol tag and make our payload to be executable is and it
can be something like this.
We have to make sure that we have just closed our value field in any field of the attributes of the
estimated tag and have to do that we have to also close our input tag or any estimate tag.
So if it was something like anchor tag we have to also close this anchor tag first.
And we have to inject or basically we have to make our payload over here.
So you could see same goes over here.
We just first grows the value field and after we just complete with the closing of input tag and we
just execute the payload.
And next one was we just execute this script to closing the script first and it is just executing our
script over here.
And same goes for this pill order two and one was the important field over here.
So when we just give the input from the keyboard and if it was converted to a string that means that
Phil is not vulnerable from the keyboard input.
So we have to this give the input from the mouse so we just made this payload which is based on the
mouse event we just made this payload to be executable when we hover over the mouse button and after
that we just made the same for this payload by taking for the another field like this some made field
saw this on mouse or in this name Peter was not vulnerable because it has encoded our payload in the
form that it won't to be executed by the browser.
But the second parameter has executed our payload which was our mouse event payload.
So we have completed all of these challenges in this LEXA.
So assume the next one.