# Introduction
:BWAPP → Medium→ HTML Injection - reflected (POST)
# Training
:As before, I did the exercises without reference to the source code. When I input the value used in the previous step, It will be output as plain text as follows.
So, I checked the input values to the server using the buff suite.
I found that the value passed to the server is encoded( <, > encoded to %3C, %3E).If I input this values, I thought that the specific function of html_post.php encode it once and pass it to the server. If I visualize what I think, it is as follows.
When I input the value, It was passed to the server as follows.
When I forward values, I could use the html tags.
No comments:
Post a Comment