Hey, guys, welcome back to another episode on How to Hack.
So now we're back to bypass front end restrictions and over here we have validation.
So, of course, as you can see here, not all the time, we will be able to just added to GML, added
a value and submit INTUITY Web application system.
And in this case, we could be managed or controlled by JavaScript or JavaScript is a script that is
embedded into the Web application system and that could manage and also control how decline browser
interfaces with the website.
All right.
So in this case, over here, we have a task and a task request that does not fit the regular expression
above to fuel in all things.
All right.
So here we have exactly three lowercase characters.
So we are sending capital ABC exactly three digits and we're sending four digits letters, numbers in
space only so we can put special characters enumeration of numbers.
So only one, two, three, four, five, six, seven, eight and nine is the law.
So we can enter digits here.
Simple zip code.
All right.
Up to five digits.
And we are putting, as did an exit with optional dashboard.
All right.
So again, we're adding in additional information and again, we're adding in about one more time.
So when you click submit, right, it says JavaScript found form errors, value entered for if you want
is not correct.
Two, three, four, five, six, seven.
All not correct.
So one more thing that we have learned as part of understanding of a Web application penetration testing
is that if you go on the web developer and you click onto network, OK, and if I click on Submit and
I click OK, all right.
As you can see over here, right.
What happens is that before OK, before we are able to submit it into the system, the information is
already being picked up by the JavaScript.
So if I click on deposes over here, we can see the information.
We have the response hater's.
We have to request headers and we can look at the parum.
Sorry.
So these are the parameters that's been sent over.
And then we have this additional fuyuko error, seven error seven.
OK, so this was also sent into the Web application system and of course we got a response.
So he says Lessoned completed his force.
Sorry, the solution is not correct.
OK, and so on.
All right.
So all this has been flagged.
All right.
So we are able to see all the details.
So the JavaScript is the first line of defense for a lot of these Web applications systems.
And all we got to do is to make sure that we have Bourbon Street running.
So to help us get out of the JavaScript from being loaded Incyte decline browser.
So all we got to do right now is go on to preferences, scroll down all the way to the bottom.
All right.
Click under settings.
And over here you can click onto Manuell Proxy Configuration.
So we have HTTP proxy one two seven zero zero one and Port eight eight eight eight.
Gohei, to click on that and now we have already launched a website so we can turn on the intercept.
OK, so go ahead and click on our proxy tab intercept and click on our intercept as on.
So I go back into Firefox.
All right.
So I can go back here into Firefox and click submit.
OK, so we will pick this up.
All right.
So I can drop the lesson overview.
All right.
I can drop the lesson manual.
All right.
And over here we have to post.
So we have got bypass restrictions, front and validation.
So we have all these different details once again.
And we can do a right click.
OK, send to all right.
Repeater, so sent to repeater and you can see that the repeater tab is now in orange.
So go in, click on it.
And this is the place where we can amend the kind of values that we want to send straight right into
the Web application system.
So in this case, we can see that we have to feel all right.
There has already been prefill doing our data all Paillot, we have amended and of course, at the end
we have this area is Arika Savard.
So as you make less error, you'll be one, two, three, four, five, six, seven.
So in this case, we're going to change the error in to zero.
So we change the error to zero.
Now we go ahead and click on.
So once you click on send immediately, we're able to put all this data, post all this data into the
Web application server and it is less and complete it.
Congratulations.
You have successfully completed the assignment.
All right.
So once again, I hope you've learned something valuable in today's tutorial.
And if I have any questions for you, if you leave a comment below, I'll try my best to answer any
of your queries.
OK, Aerolite share, subscribe to the channel so that you can be kept abreast of the latest cybersecurity
tutorial.
Thank you so much once again for watching.