Now let's test the next two websites where this test is Snapple you that Kemosabe Solis insert this
in the board Bible is done here and it is started to crawl even.
So let's go to the target select the target and it is just fitting so little to give her time to face
some of the Ural and I'll just wait for a moment and see how this works.
So.
So I've got or face too many link.
What you see.
It has only the two barometers that is visible.
So if I just make these sorted so if I just press two times this param tab then it will get us a sign
up in a source.
So let me just say this if I just click on that it will get the information over here.
So it has some of the barometer.
So most of the parameters are here.
So let's send this to our repeater because repeat rules see if we have the any parameter that is vulnerable.
So let's pause for maybe it is encoded or here so our device source
okay if a source for maybe gender.
So the source from gender studies is a female if I just press go
let's see for female.
So female here is injected inside here that is in the onsen.
That is a function of the script.
So it is injected inside the script here.
So that means we have to make the payload.
So let me just grab everything from this script to this part where this is injected.
So let me see this graph to this part let me copy these first opened the sublime again.
This pasted here.
So this is the female and female has been injected in this gendered part.
That means first of all will simply close this script because it is injected into a script.
That means we have to close our script.
So first of all I this close my script and after I close this inject my own script so I'll see script
alert to one and close my script.
So this to be Lord and this would work.
So let me just copy this go here.
The female as this base our new payload.
Let me this piece go Let me see the response in the browser let me just copy this link go over here
best in go and it is showing us the pilot of one.
That means that was the field that was vulnerable over there so you could see we have got excesses attack
in this field that is a gender you can also try for this fail and every field over here.
So let's go for another and see for the sign up place.
And this again to the repeater and you could see we have a bunch so bad image over here.
So this source for this first name or get something like you to me and let's see if this works let's
press go
let me source again for you to me and it is showing no matches that means this is not one.
So let's go to the center and say from
less now source for your VM it has a nomad.
So you can source for everything over here so you can source for the password you can source for the
telephone over here data for your data birth everything so you can sort this perimeter and if it reflects
over here that means it has a vulnerabilities and you can also send this to the intruder to launch your
own payload so you can load your payload and see the response with this is that attack tab over here
are the button and see the response and see which of these payload work in that field.
So this is the way to SaaS or hunt for the axis this attack on the Labor side see you in the next one.