Welcome to this lecture in this lecture will haunt for the excesses in the website which will be our
test Web site with the filter bypassed payload so you can simply go to the Google and source for payload
list it's always script.
You'll get this github link.
So let me just open this and wait for a moment.
OK let this see that this is they access this payload.
So let me just grab all of these and let me just copy this and let me just make one new notepad and
let me just paste it down here.
So first of all let me copy pasted here and you can simply say this is the axis dot DST or simply I
access this file so I've already created that file right here.
So now that is our payload.
Now we have to this insect that belonged to the intruder of the birth suit in this web.
So first of all you have to see that your property is on or not.
So go to the setting make sure we have a district that is manual proxy configuration.
So let me just okay.
Okay so this is our test Web site.
So let's open the box.
Let me this first copy this link because we need to crawl that.
So let's start new scan.
Let me just press okay and it will this start to crawling that base.
Let me just go to the target here and you will see.
This is the base.
So you'll see bonds of the log in and we just get here the barometer.
So we have the test perimeter where you can simply put some of the values.
So let me wait for a moment to see.
We just can get some other parameters.
So all you need to do is simply press this perimeter twice so as to get in the descending order.
So we have a bunch of four paces away as low let's me this go to this p p barometer.
So I'll just go here and first of all all you need to do is send to the repeater to see if this is reflected
or not.
So instead of twelve either say hello or something like that.
So let me just press go and let's see if this works.
So the source for hello.
And it has been deflected over here in the encore tag.
So that means said this is the one level.
So all you need to do is simply send these two into the.
So I'll send this to the intruder.
And this is our intruder.
So go to the position.
So here we have to inject your payload in this halo so you can simply clear select these people feel
added right here.
So it should be over here.
So I just made a mistake.
So let me just clear it one more time.
Let me just press this and let me just add it.
Now I want to go to the payload and we have to load that bill or no.
So it should be in my deck stop.
And that is the excesses start DST that we just made and all this but this too this is all the payload
that we have just made use of.
So you can also insert your own payload from here if you want.
So you can simply make your own payload to see if this works or not you can make simple and something
like that and you will just add it so up to use us to make this a law that is our payload list.
The simplest list and you can see the number of payload you have here.
So I have one hundred nine.
You can have more than this so there is a simple thing over here so you need not to touch this payload
processing and this is basically your payload encoding so it will just make you use up this encoding
in this CTP request.
So next one is to simply go in the right inside and press this is that attack.
So let's give this a little bit of time to see how this works.
So let me just wait for a moment.
And it has this man all the attacks.
So you could see now we have successfully made the attack on each of these payload.
Now all you need to do is simply go to the land and you could see this first one over here is having
the EMT that means it has also tested for the empty payload and put the empty payload.
It has the land of 576.
So anything that is greater than 576 has a likely chance of getting one label so I'll just by Slim click
on this land and it will just made our land highest at the top.
So that means that this payload has highest chance of getting basically injected or basically getting
in fact dead.
So let me see the response to the browser.
Let me just copy this go over here and let's see if this works or not.
So it has not worked.
So you have to take form a bunch of here.
So let me just go LSC for this one so I'll just say so response to the browser in the future.
So the styling and space it again best and go.
And again this is not executable even so you can see that we have not got any chance of success still
now.
So let's hope if this horse are not.
So this one's in browser.
Let me this question down.
And again this is also not working.
So what has happened is simply our payload is not working correctly.
So let's see for this one.
So this was the process.
I think this must work OK.
Again this is also not working.
So this has been encoded right here.
So let's see some other one and this go for maybe the simple day or we can go for maybe this one let
me see the response to the browser.
Preston go in again.
This has not been duplicated again.
So that means are fair to get some of the important spare material so you can take for all of these.
But I am not wasting any more time on this because I want to test for their know the perimeter now.
So let's go to the proxy.
Let's go to the target endlessly for another barometer.
If we this can get for another better medalists test for this test field.
So as this go here and Okay let me this go for this one.
Let's see.
Let's send this to the repeater and let's see if this works or not.
So let me see for the repeater and instead of this get request as the source for the post request.
Let me just go for the post.
So we have post here for the test.
Send this to repeater to see if it has any existence at all.
So you could see that it is a simple test.
So adding it has not one level again.
So let me just see for next post if this has it feel.
Send this to the repeater.
Let me see here.
So this has some text.
Let's see if this works or not.
So I'll just pass here.
Hello.
Let me quickly please go and let's see if this helo has a reflective not not so low has reflected but
in the position that is not one was.
Let me just go for name.
Say you mean and let me express.
Go again.
Let's see if this reflects or not.
So it has been reflected in this strong.
But I think this test for this name instead of that as this go for another parameter again.
So let's test for something that these over here.
So is has the highest land.
So let's try for this.
So send this to the repeater.
I'll just go to the repeater.
Now this has one here.
So that's possible.
Hello.
BRISCOE let's see if this helo has been inflicted or not.
And it has not been inflicted.
That means this is not wonderful.
So go right here to the target again.
And now I see for again for another barometer is this now for this one again.
So let's test for this post.
Send this to repeater.
Go by here and let's test for these queries to see you them again.
This is the school.
And let's see if this reflects or not.
So it is not reflecting.
So again go to the target and list serves for something that will get a hold exorcists attack.
So let's see do now.
We are not sexist or we are not getting anything.
So let's send this to repeat.
Let's see if this works.
So I'll just pass yes something like.
Again the UDP.
Let's see.
This works so it is saying You must log in.
So let's say again they used me and against this.
Go.
Okay.
It's not working.
So we are not sexy.
Delete.
So let's see for this pic.
Send this to the repeater as always so are the same.
You damn me again.
Endless source.
This one I think it would be reflected in so we are not getting success still yet.
Let's see for any other link if I just get this B.
B Let's see let's send this to Peter.
Let's go to the repeater lists for people we feel.
I think this will be wonderful.
Let's say hello.
Hey um let's see if this is reflected or not.
So I think this is reflected because Halo has been reflector over here so let's send this to the intruder
and check for our payload list.
So I'll send this to intruder got to the intruder position so I won't do this inject into this people
feel.
So let's clear this.
Go to the people feel or select everything on this.
People feel this.
Add this code to the payload Lord our simple payload over here which is this payload and this is start
the attack
let's wait for a moment.
It will execute all of this and it do this sort our land and now it has also sworn us something over
here.
So let's go for something like this.
So this is a response to the browser.
Let's hope this is fun.
So it has not executed.
Now let's see.
Careless sorts for this one I think this will be executed.
So let's see for this one maybe so response in the browser.
Source URLs below.
Okay so we have found the payload that is working now.
So we just got this payload that has successfully worked so you can just see it has something like the
land to be 215 214 but this payload has successfully executed to this BP bad image so you can simply
slow response to the browser get a link based and go and you could see your at the link or basically
your Jarvis code has been executed on the browser.
So this is the way to inspect all the payload so instead of just making your own payload line by line
you can just make a list of a payload you can inject that and you can just enter or insert into the
sudden position after you see that in the repeater that if the field has reflected any of the input
then you can simply go to the intruder select that position and go to the payload section and the slaughter
payload on the list of payload.
In my case I have a 109 payload count and start the attack and anything from the land that will be one
to ten from the descending order will have the highest chances of getting vulnerable.
So that field you can discount and you can simply saw a response to the browser based your lingo here
and see if your javascript code has been executed in the browser or not.
So this is the way to do this bypass to filter the payload list in this basket.
So this is the way to work with the intruder and the repeater so you can simply make use of these people
feel you can simply make your simple payload like here.
So I'll just make a script and alert and give some messages and simply close my okay.
This should be script not alert.
Script tag and you can simply press go again and simply so response in the browser.
Simply paste it down here simply paste it and you can see that it has reflected so you can just check
for the excesses attack from the repeater from the intruder.
So intruder is very useful if you want to test for multiple payloads and if you want to test for single
payload you can go through the repeater.
So these are the two important to see for the existence attack in the way sets.
So this will be rare for this Lexus soon the next one.