the textbook. Then, please do chapter 12 quiz on Moodle and do Infosec Learning Lab 12 - Remote
Reflected XSS Mitigation and URL Encoding. You should first watch the 3 videos under the "Introduction"
section. Then, complete each of the 5 sections as well as all the challenges in the lab. There is also a
writing assignment for this week's Infosec Learning Lab. Therefore, you should submit a pentesting
report file to Moodle Chapter 12 Infosec Learning dropbox.
The last section (Pentesting Assignment) asks you to explore how to bypass the preg_replace function in
order to execute the remote reflected XSS attack. Here is how the correct result should look like:
Explot-DB. Aa Aircrack-ng
Most Visited Offensive Security Kali Linux
Kali Docs Kali Tools
Owned
OK
In the assignment, the preg_replace function replaces the keyword script. To bypass it, you can use the
same method you used in Week 8's Infosec Learning Lab Pentesting Assignment - Reflected XSS
Mitigation and URL Encoding. You can review the following webpage "XSS Filter Evasion Cheat Sheet".
(You might need to click "Yes" to allow your antivirus software to access the webpage).
https://wiremask.eu/articles/xss-filter-evasion-cheat-sheet/
If you read that page from the beginning all the way down until right before the section heading
"htmlentities", can you find out how to bypass the preg_replace function?
The following video is also helpful:
https://www.youtube.com/watch?v=8NielPoOA6s
However, there is a difference between what you should type for this week's lab and week 8's lab.
Because the preg_replace function in this lab removes the brackets <> in addition to removing the
keyword script (