Starting off inside of our lab environment,
carrying on from the last portion of this skill, remember we have BWAP already opened up
inside of a web browser on the Ubuntu desktop. Now, we'll go into the actual BWAP site.
On the top right, and I'll try to zoom in for us as best as I can,
you can see the choose your bug here. We're going to be going down to the XSS reflective
and I'll show you here. So there's a whole section of cross-site scripting.
Now, the reason I'll point this out is because there are plenty of cross-site scripting examples
that we will probably get into later on throughout this course for other reasons,
as far as exploitation to a system. That being said, the only ones that we're really
going to be worried about are the reflected and the stored. We're going to be starting
off with reflected first and the get one, the first one that's actually in the list
is selectable. And the reason for this is it allows us to be able to get a firm understanding
of how this actually works. So I'm going to go ahead and select that. And once I get my mouse
back in there and go down one to reflected get, and then I'm going to hit hack. And it'll take
you to, after I forward all the requests to this page that you see up above. Now this right here,
it looks like a standard website. As I zoom in for us, that just says, enter your first and last
name. And you can see that I've already done one below where it says, welcome ASDF. But whenever
we type our credential, or let's say our first name and last name, which is going to be ASDF tab
ASDF, and we hit go. I'm just going to forward the way. In fact, for a second, I'm going to turn
the interceptor off. You can see that inside the actual address bar, we have all the actual PHP
info for the actual form request. So you see XSS underscore get dot PHP, question mark, first name,
et cetera, et cetera, et cetera. So all the form information goes into the actual request itself
to be sent to the actual server hosting the website. Now I do want to touch on actual defenses
for just a moment. And one defense that you can put in here right away is the fact that you can
mask the actual URL to not show the entire request going on here. And this is done inside
of the actual server settings. So in this particular case, it'd be IIS. And you could only get in
return to bwap.test slash bwap slash the PHP file name, not the actual question mark and everything
else, because everything else from that question mark on would be covered up. And most users
wouldn't be able to see that. However, the request is still sent inside of the actual
request itself to the server. And that's where our interceptor comes into play. Because as we
zoom out and go back into our Kali box over here, we're going to turn interceptor back on.
We're going to send the request one more time. ASDF, ASDF, we're going to hit enter for go.
And inside of our Kali box, there we go. You can see that we actually got the request. Now I'll
zoom in for us real quick, make sure that I can do that. There we go. You can see here that lines
one through 11 is the actual HTTP translation and all the coding that goes from the actual submit
button to the actual server itself. And we know this because in line one, the first word that we
get is get. And you can see that is slash bwap slash XSS underscore get dot PHP and the rest
the actual request itself. But since we've intercepted this actual packet, we can make
changes right here in a reflective manner to the actual user before it actually gets to the
Windows 10 bwap IIS. And I want to show you just an example real quick. And I'm going to try my
best to be able to put all the code inside of a code box below. But for instance, let's say we go
right after the question mark and delete out the first name and ASDF portion and replace it with
script alert one with the parentheses and then a slam right after that. I can't. Yeah, it should
be a slam. I accidentally deleted too much, which is why I will have the code in here.
So I'm going to send the request again, first name and last name. And inside of here,
our burp suite, let me zoom in for you real quick. What we're going to be taking a look at
is the actual first name, but you can use either one, but we're going to stick with first name for
right now. And we're going to do something simple by sending the alert. And to do that, we're just
going to go inside of our first name here where it says QWER and we're going to paste in a script
for alert one, meaning send the message of one and zoom in. This is what it looks like right here.
So we're modifying the packet before the request, before it gets sent to the actual web server
to send us something in return. And so right here, you can see first name has been replaced
with script alert one, close the script. So now we can go ahead and forward this.
And there we go. And you can see that on the BWAP site itself that we had an alert pop-up of one.
Now this in and of itself may seem mostly harmless and really this was, but there's other
things that you could do with this as well. Now I do want to point out before we start going into
those other things that you could also capture the packet and modify it later on as well too.
And how we do that is inside of burp suite is I'm going to send another request from our BWAP
terminal, first name ASDF, last name ASDF, and go ahead and send it. You can see here that it
captured the packet inside of burp suite. I'm going to right click on it and go to send to repeater.
And inside of our repeater tab, we have the exact same packet there. Now, if I go back
into the actual proxy itself and turn forward all and turn interceptor off, that packet will
still remain in repeater so I can modify it and send it on its merry way. So, I'm going to go ahead
and replace the ASDF with the actual script itself and go to send. And you've noticed that on the
BWAP site it didn't do anything. That's okay because in here this allows us to be able to
recreate what the user would actually see on their end if this were to actually get implemented. Kind
of a test or being able to retrieve data for ourselves in return. You can go to the render tab
down at the response section and see the actual website, but you notice that the alert didn't come
up and that's because the alerts like scripts and other pop-ups due to scripts don't work in the
render section of burp suite. So, what we do is inside of the request field, we right click and
go to show response in browser. And this will create a copied link already for you that you
can go into your burp suite browser and paste inside the bar, hit enter, and you'll see that
you get the pop-up as well too. And when you hit okay, you go to the actual site on our BWAP station.
So, now we know of a method to be able to intercept and do cross-site scripting on a very basic level
and we can actually keep the packets for us to be able to examine later on as well.