Now I'm going to show you inside the lab, but I wanted to explain this real quick because
cross-site scripting requires a little bit of setup that requires us to be able to go
through back to previous skills.
In order for us to be able to properly and effectively cross-site script, we have to
be able to intercept traffic going to, at least to, the website that we're wanting
to be able to mimic or affect.
That means that we're going to have to be able to capture the traffic from this dude
right here to this website right here.
And here in the middle is going to be us copying and listening to traffic.
This is why sometimes cross-site scripting gets confused for being a man in the middle
attack.
Now inside of our lab environment, this dude right here is going to go through us a proxy
inside of their web browser settings in order to go to the website over here that they will
inadvertently be sending data across that we will be receiving back and forth.
Us being the proxy in the middle allows us to be able to see data in its rawest form
going from point A to point B.
I want to point out that we're going to be doing this through HTTP and not through HTTPS.
A lot of reasons for this, and primarily it comes down to whenever a website is wrapped
with SSL or TLS, that data in motion is encrypted and wrapped.
Now this means that it would, it's still possible, but this means for the purposes of our lab
environment, it would be very more complex and we're going to be getting into how to
unravel all of that traffic later on in the course.
So then you could come back and apply the cross-site scripting tactics we learned in
this skill once we learn how to be able to attack SSL and TLS.
But getting the basics of what it is when we cross-site script is very important.
Now I'm going to be hopping over to the lab here in just a second.
So that way we can see the actual setup that we have for our lab environment throughout
the rest of the skill.
Now the setup that you see here inside of our lab is basically what we were just talking
about.
We're trying to keep everything self-contained to where it makes for more of a conducive
learning environment.
So in this particular case, the window on the left over there, the Ubuntu box will be
that dude over there.
And the Kali box will be the proxy in the middle and the website will be wherever we're
actually trying to go.
And where we're trying to go is actually on the Windows 10 BWAP server, the IIS server
that we're using for practice inside of our labs.
It's one of the Hyper-V virtual boxes.
And that'll be that website over yonder.
And the Kali box on the right, which is the one right above me here, being the proxy in
the middle.
Now, as you can see, I already have Burp Suite open, and that's what we're going to be using
to be able to go in and check some of these different web requests to be able to perform
a cross-site scripting attacks.
But that means that inside of our Ubuntu, that dude over there, we're going to have
to set up a proxy.
Now this is pretty self-explanatory and straight forward.
Inside of our Firefox, which is what this is inside of Ubuntu, you just go to settings.
And the easiest way to do that is in find settings, just go ahead and type proxy.
And I will be tapping back and forth so that way you can see right there that we can go
into those proxy settings.
Now we already did inside of our skills before with Burp Suite understand how to set up the
actual proxy for the Kali system itself to be able to intercept requests.
What we're doing here is now pointing this particular Ubuntu box in Firefox to that actual
Burp Suite proxy so we can capture all the traffic.
And as you can see here, we already have 192.168.0.53 set up as our proxy on port 8080.
And that's our basic proxy configuration inside of Burp Suite.
Now, that means that every web request based on this configuration will go through Burp
Suite on our Kali box for interception.
And I'm going to close this, come over to our Kali box here.
And you can see inside of Kali that we already have, there we go, web requests being in pending
status for us to be able to forward through.
Now the reason they're in pending status is because as you can see in blue up there, we
have interceptor on, which means that we're going to capture the packet, hold it, and
see if we want to modify it or do anything to it to be able to send it on its way to
see what the user gets back in return.
And we'll be demonstrating that shortly.
I just wanted to give you basically the introduction for the skill to get you set up to where we
can actually practice this in a safe lab environment for our cross-site scripting attacks.