Why you should never use eval() in JavaScript. Reflected DOM XSS Attack.

Описание

This is a walkthrough for Burp Academy's lab with the title 'Reflected DOM XSS'.

As the name of the lab implies this is both a reflected AND a DOM based cross site scripting attack. It explores the dangers of using the JavaScript eval() function which takes a string argument and processes the string as JavaScript.


Support This Channel
======================

Please like and subscribe, it means a lot!

Please buy me a coffee so I can continue to make content.
https://buymeacoffee.com/zenshell

Join our Discord
https://discord.gg/pBcXkvzu


00:00 Introduction
00:11 Exploring the lab
05:46 Javascript eval() function
06:28 Following the lab flow
08:03 Analysing vulnerable AJAX request
11:47 Recreating the lab
17:48 JSON vs JavaScript objects
19:49 Why you should never use eval()
21:28 Final pointers