Okay, now let's go and very fast create another method to test excesses on a form.
Okay.
So in here I'm going to create this method.
Let's create this by the name of.
This exists in a form something like that okay.
This is an end of our something like this.
So first we need to give the self keyword to this method.
And then we need to give a form.
And then the very important thing which is the URL.
So here I'm going to give the script.
Okay.
It is going to be excesses.
Underscore is underscore script.
It is going to be equal to in here I need to give the script.
And in here let's provide the thing we want.
For example, it is going to be an alert.
X is S, and if it is filtered that you are not able to use this, then you can add some change here.
For example, make this C capital here and also P or one other letter capital here.
So it bypass the filter okay.
And the next thing is to use the submit form.
So I'm going to create another variable name it response.
So it is self dot submit form.
And in here we are going to give the format as the first variable as the first argument.
The next one is going to be the value okay.
Now the value is going to be x axis test script, and the next one is going to be I think URL.
So here add some.
Space okay.
The last thing is that we need to check okay.
We need to check if this x s is test script is in response that we just get it okay.
Just we got that content.
Then let's return something.
Return true.
And right now as you see, this x s test script is a something like string.
And also this response dot content is object or it is byte object.
So if you want to change this to this and then check it because there is string.
We cannot check it inside here.
So we need to change this to a byte object.
So byte type object.
To do that we use encode method here.
Okay.
So it will encode that.
Then we will be able to check it here.
Now save this and then go to here in this part as you see here we are using Submitform.
So I'm going to remove this or let's check it first.
Here we have extract form.
So it will extract this from this link.
No problem okay.
That is what we want.
And the next one is submit form.
So I don't want this okay I want something else I want the method that just I created.
It is called test cases in form.
And the first thing I need to give is the form itself.
So the form come from here.
The next one is a URL that we don't have a value here, so I will remove the value.
Let me show you.
You see we have the first thing as here form.
The next one is URL.
And the same thing goes here we have the form and then we have the URL.
So I will start checking that in here.
Then we print the content not the content, only the response okay now if I save this and then if I
come back here use Ctrl S to save this.
And let's go and execute this to see what is going to happen.
Okay.
After a while you see we have none here and I know that is why.
We have none.
And it is uh, it has a reason.
But if we could be if you if you were able to to do the attack.
So you must see a true here.
Okay.
But you didn't saw that.
And that is because of a high security.
Because this, this machine you see here, it has, uh, something in here that has, uh, security
keyword that is high.
Now we need to change it to low or medium to test our script here.
Okay.
So, uh, you need to come to this location var ww vw VW includes.
And in here we could find the file or let me go there.
Okay.
You see the var w ww and then dv w a dv w a.
And then we have in quotes and then hit enter reduce lz.
In here we have a file called dv w a page dot inc dot php.
So we need to edit this.
I'm going to use nano here.
Nano.
Then let's use sudo first okay sudo nano.
And then we have dv w a page.
DV a dv w.
H dot inc dot php okay.
Now let's hit the down arrow and come down here.
It doesn't have any line.
So in here you see we have setcookie and it is security is.
Hi.
Okay.
We need to change this I'm going to change it to medium okay.
Medium.
And then use control x and then And why?
And then hit enter.
And that is it.
Okay.
Now, if I came back here and re-execute the program after a while, you see, we have true here.
Okay.
That means it happened successfully.
You are able to execute your script.
That is here.
Okay.
A small script here.
You were able to execute that in here.
In this form.
In this location.
So let me show you that here once again we have script.
And again we have.
Script.
And then we have alert here okay.
For example is going to be XSS.
Now if I hit enter.
Just a moment.
If I hit submit, you see that we get XSS here, okay.
And the same thing goes with the script.
Okay.
I was able to execute my script here.
Okay.
First I extracted this form and then I entered the the thing I wanted, which was the script.
And then I hit submit.
And you saw that we got the true, uh, keyword here.
True.
That means we are able to do that.
Now I am able to use this functions here.
Okay.
But before that, let's go and see how we can do this kind of attack on, uh, links as well.
Okay.
So here you saw how we did this on a form.
And we will be able to now to test that to use it here.
And I will complete this in the next videos.