7.2 Reflected XSS Attack Lab Instructions

Video Activity
Join over 3 million cybersecurity professionals advancing their career
Sign up with
Required fields are marked with an *

Already have an account? Sign In »

12 hours 9 minutes
Video Transcription
everyone welcome back to the course. So in the last video, we wrapped up our discussion on cross site scripting. So we talked about things like reflected versus persistent or more commonly called stored cross site scripting
in this lab, or to go ahead and do an example of reflected cross site scripting. So we'll take a look at that, what it looks like and what kind of output we get back.
So let's go ahead and get started. So you should already be looking to the cyber a environment and you'll want to make sure you launch the old lost Labs and specifically the cross site scripting lap. Now I already done so you'll see that they're there in the background and we've got our user name field for Callie Lennox. So let's go ahead and get logged in.
So our user name and password are gonna be the same for all these lab. This is gonna be the word student
all over case,
and then either click next or his press internal keyboard and then just student again all over case, and then either sign in or just hit and turn the keyboard, and it's gonna go ahead and get us logged into Callie Lennox.
Now. One minor difference in this particular lab versus others. If you want to get your percentage completions. If you want credit for the lab, what you'll need to do you'll see on the right side here, as you want to, just make sure you click through these particular items and check the boxes, so that's kind of the main difference in the other
lab view. You'll notice that the bottom there's instructions. You'll just click the done box and the next next, next, all the way through. And it'll automatically register your
percentage that you've completed. Whereas this particular lab and a couple of us in the course will be this new formatting where you'll just check the box as you complete each task and you notice the percent is changed as I click in complete a task.
So if you want credit for the lab, make sure you follow along and do those steps. They're just check the boxes and click all the way through is you're going through the lab, and that way you can get 100% completion.
So the first thing we're gonna do here is just uh, take off our screen lock. We're gonna cancel it essentially, so that way we don't worry about this timing out on us, and we can actually go through and do the lab.
So the way we do that, it's just at the top, right click the little arrow. It's gonna pop out a little menu for us. And then at the bottom left, there's a settings icon. What it's gonna click on that
it's gonna take about 4 to 5 seconds or so. It's gonna open a new window for us and you'll see it's open right there. We're gonna click on privacy. It's down near the bottom left. So this one right here
and the next we're gonna click on screen lock. It's gonna open a pop up pop up window for us and that we're just gonna take this top circle here and just move it to the left so you can click to it or you can click on it and drag it to the left. Once you've done that, that turns off the screen lock. So all we have to do now is just X out of these,
and we can actually start our lab now.
So we've already loved into Kelly Lennox. Here and again, they step by step. Guides are available for download on the supplemental resource is section. So if you haven't done that yet, for some reason hopefully you've done it since we're getting close to the end, Of course. But if you haven't done it yet, make sure you go download those that where you have access to all the materials you'll need to finish these labs.
So we went ahead and loud in our Callie machine. The next thing we're gonna do is launch chrome, so it's gonna be the second icon down. It's kind of a grayish blue icon here. Just go ahead and click on that. And if you have your mouth's overtop, it says chromium Web browser. So that's what we're using the side of Cali Lennox here.
And that's why the icon itself looks different than what you might be used to that on like a windows machine, for example.
All right, you'll see you automatically open up the Mattila Day site for us.
All right, so first thing we're gonna do here once that side opens up now again, if you get an air message in the sights. Not cool enough for you. Just click the little Mattila Day icon here and near the top left on. That should refresh the page for you. And you should be good to go.
So what we're gonna do is we're gonna cover our mouths over top of a lost 2017 were. Then I'm gonna navigate to the A seven, the cross site scripting one we're gonna click on reflected
and then password generator. So let's go ahead and do that now.
So all last 2017. Just cover your mouth over top there, Go down a cross site scripting
go to reflected his top option here,
and then we're gonna go down here
and scroll down a little bit. And let's go back up here.
You have to scroll down just a little bit to get the one we need.
So reflected on. Then just a little ways down. You'll see the password generator. There we go.
My take is mama or so and he should pull up for us, so we gotta pull up there.
All right, So now what? We're gonna do it. We just finished. Step 10 here. So we've clicked on the password generator. It's pulled up that page for us. What we're gonna do in the u R. L bar here were to change the word anonymous, and we're gonna change that *** wear t. So we're to change anonymous to quality in our Eurail. So you see, at the end here, we have anonymous. Just click in there.
There were changes word too quirky, and then press enter.
Or so now
we want to see if there's a user name showing up in the u R L now. So since we changed it to clarity, do we actually see a user name showing up in the address bar here?
Well, the answer is yes, right? It's actually pretty easy to see the hears. The name is queer T s O. That was actually kind of an easy one.
So next thing we want to do here in step 12 we're gonna right click on the page. We're gonna view the source code of the page,
and you can actually do this for any website you're on. So if you want to impress your friends and family, you could just right click on a web page and you'll be able to view the source code for that particular Web page. So we just right click on it. And then here, we're gonna save you page source,
take a second or so you'll see all sorts of information in there for us.
Specifically, What we're gonna do is do a search for quirky. So we're gonna hold on the control button on your keyboard, and then we're gonna press the letter f while we're doing that, that's gonna open up a search box for us or basically a find box. And then we're gonna type in queer T in the search box to see if we find the user name of Queer Tree anywhere in this coat.
All right, so a lot of stuff I just said there, but basically all we're gonna do is
in here. Just click in the in the code anywhere here. Just hold on control and then press f on your keyboard.
You'll see it gives us that little search box at the top here,
and then we're just gonna type in quirky
and see if it pulls up. If it shows the years of name for us
so you'll see they're almost instantaneously. It was finding quirky. You'll see here it says the this password or, you know, this this information here, this password that were defining is for this year's your name right here. So this is the user name that's associated with whatever password we're we are referring to.
So we were successful there. We were successful in our search, So we did find the user name of Quartey.
So now what we're gonna do is we're just gonna add some malicious JavaScript code. No, it's not really malicious code for our purposes. It's really just kind of creating a little a little test for us. A call like that cause I don't want to give away the answer to question number three, but we're just gonna basically type this aspect of the u R L R.
On. And then once we get enter, it should
do something. Hopefully, we'll just leave it like that.
So what we're gonna do first, we're gonna close this view source tab here is going to close that out and then in the u r. L were to type this command right here at the end of it. So
right here. Wait. Where we have quickie. We're just gonna go continue on and add the rest of our command here. So you'll see we already have clarity. So we don't have retyped that. But we are gonna add quotation,
a semi colon, and then alert. So we're gonna take this step by step like we normally do. So we'll add double quotation, and then the semi colon and then a space, and then the word alert. So let's go and do that now.
Double quotation semi colon space handler.
All right, so now we're gonna add the parentheses,
and then inside of that, we're gonna say malicious JavaScript inside a quotation, so we'll have parentheses and then inside of that will have quotation marks. And inside of that will have malicious Jarvis groups was going type all that in.
So right after the alert here, we'll start that.
Just type in the prentiss, see a movement mile, secrecy, parentheses, quotation Mark, Melissa militias. Excuse me, JavaScript.
And then just close it out with quotation marks and prentiss e.
And then also add a semicolon at the end of that and put a space.
All right, so now we're gonna type in V. A r r variable is what it stands for Their Sova, our space test X y z. So let's go and take that in there.
So v a r space tests X y z
All right, so next what we're gonna do is just put the equal sign a quotation
mark and then test. So equal sign, quotation and tests
equal sign, quotation and then test. And once we type that anyone is gonna have press Internet keyboard to go ahead and run that command.
All right, so now we have question number three here after we've run that command, Do you see a pop up box and mentioned something about malicious JavaScript? So this one was somewhat easy, and I tried not to give it away, but yes, we, of course, see a couple boxes says a malicious JavaScript here. Now, again, we weren't running like, real malicious code here. This is just a test too.
Give us a papa box so we could take a look at that.
Well, this is how reflected cross site scripting will work now, as we mentioned before And the lecture series cross I excuse me, reflected cross site scripting. If I closed my browser a za victim essentially, the risk goes away rights. That's where we get into the stored crisis. Scripting was, which is a more dangerous and more persistent form of it.
So this video, it's just real. How the high level overview of reflected cross site scripting and the next module we're gonna go ahead, talk about insecure D serialization.
Up Next