Why you should never use eval() in JavaScript. Reflected DOM XSS Attack.
This is a walkthrough for Burp Academy's lab with the title 'Reflected DOM XSS'.
As the name of the lab implies this is both a reflected AND a DOM based cross site scripting attack. It explores the dangers of using the JavaScript eval() function which takes a string argument and processes the string as JavaScript.
Support This Channel
======================
Please like and subscribe, it means a lot!
Please buy me a coffee so I can continue to make content.
https://buymeacoffee.com/zenshell
Join our Discord
/ discord
00:00 Introduction
00:11 Exploring the lab
05:46 Javascript eval() function
06:28 Following the lab flow
08:03 Analysing vulnerable AJAX request
11:47 Recreating the lab
17:48 JSON vs JavaScript objects
19:49 Why you should never use eval()
21:28 Final pointers