In our challenge, we set out to see if we can combine the two cross-site scripting efforts
of persistent and non-persistent. Basically, to see if the first part of the skill can be
tied into the second part of the skill. And the reason that I wanted us to be able to try and do
this is because basically, we need to be able to say at the end of the day, if it's possible
to cross-site script one, and if it is, maybe one method of attack isn't working and we need
to use another one or a combination of the two. So, we're going to try Reflected and
Stored at the same time. Now, in Reflected, we were able to intercept traffic from our own
Ubuntu desktop using Burp Suite. So, inside of, let me swap over here real quick. You can see
that we have the BWEP page pulled up in Ubuntu desktop for the Reflected Git, where we do our
submission. Now, I've already sent a submission and I've captured it inside of Burp Suite.
And I sent it to Repeater. And the reason I did that was because I wanted to modify the script.
And by modify, I mean a lot. And so, I have it highlighted there. Now, don't you worry,
I will have this in the code box below for my solution here. And while this does look mangled,
this gives me an opportunity to explain to you something I hinted on earlier. And that is with
the percent symbols. This is what's referred to as encoded URL texting, encoded URLs. And this
allows us to be able to send symbols and spaces inside of a web request efficiently and also to
make sure that they get through because not all systems out there recognize things like spaces.
And so, this is a big, think of it as like a form of ASCII for web addressing and being able to
do URLs. You've seen a lot of URLs that have spaces in them that with the percent two zero
for space, that's the percent encoding symbol for space. And you can see throughout this
string of code here that I've had to encode different things like parentheses, slashes,
spaces, and so on. And so, that's what we see here. And I injected it into the first name
submission box. So, that way when we submit, it says go to steel.php on 0.53 and submit the
encoded URI component of document.cookie. So, when we send this, as I zoom out and go back over,
I'm going to take a look at the actual, not that one, open up Notepad QQ. You can see there that
I don't have anything up my sleeve. In fact, I'll save it right now. And when I send this request,
I'm going to pop back over to, oh, excuse me. I sent the request. I need to right click and go to
show response in browser. I'm going to go to the browser and I'm going to paste it in there. You
can see just that quick flash of what didn't look like VWAP. And as I tab over to Notepad
QQ, you can see that we have a reload request. And once I reload it, you can see there on line four
that we have all of our cookie information from our persistent attack of cross-site scripting
like normal. Now, you can see that it is a little truncated, but we do get the base
components of whatever it is that we need. Only thing that we're missing out of this one is the
session ID. And I didn't really anticipate that, but I did want to show you what it looked like
to be able to combine the two. Now, there are tweaks and modifications that you could do inside
of steel.php, but that's not what this skill is. It's basically just to show the components of
being able to cross-site script. And this is a way for me to be able to use the best of both
worlds, meaning that I have something already set up on the outside like steel.php. And I use the
blog entry to be able to put in the fact that I have a method of persistent tagging of folks that
come into the blog. And if I use the submission form and capture those packets through like
burp suite, I can reform that and get the exact same data, if not more based on my coding to be
able to go in and see everything that I need to like the IP addresses, the user agent information
and session IDs. So it can get as simple or as complicated as you want. It's just a way for us
to be able to combine the two efforts, or we can use them individually like we saw earlier in this
skill. But long story short, cross-site scripting has a lot of advantages for us pen testers because
it allows us another avenue of approach or threat vector for us to be able to go through and do
actual testing, not only against the servers themselves, but also against the clients
of our specified scope within the rules of engagement.
I hope this has been informative for you, and I'd like to thank you for viewing.