extends layout

block content
  h1 Server Side JavaScript Injection
  //- TODO: Add Conext
      //- https://ckarande.gitbooks.io/owasp-nodegoat-tutorial/content/tutorial/a1_-_server_side_js_injection.html
      //- https://nvisium.com/blog/2015/08/27/the-evil-side-of-javascript-server-side/
  p.
    For many years client-side JavaScript exploitation has been the focus of
    web application security research - with the advent of JavaScript run on
    the server in recent years, new exploitation research has taken off. As
    the web moved toward ever-increasing use of JavaScript to make sites
    reactive and easier to develop, Server Side JavaScript Injection evolved
    as one method for code execution against the host server.
  p.
    #[a(href="https://nvisium.com/blog/2015/08/27/the-evil-side-of-javascript-server-side/"] nVisium
    has a good write up on how Server Side JavaScript Injection occurs, as
    well as examples on how to exploit web applications using this
    exploitation method.
  p.
    The following form is vulnerable to a Server Side JavaScript Injection.
    Exploit it to read /etc/passwd.
  div
    form(name="search", method="post")
          div.input
              input(type="text", name="query", placeholder="Search...")
          div.actions
              input(type="submit", value="Go")
  p
    //- TODO: Figure out how to properly reroute to index
    a(href="http://localhost:3000") Return to Index

extends layout

block content
  h1 Server Side JavaScript Injection
  //- TODO: Add Conext
      //- https://ckarande.gitbooks.io/owasp-nodegoat-tutorial/content/tutorial/a1_-_server_side_js_injection.html
      //- https://nvisium.com/blog/2015/08/27/the-evil-side-of-javascript-server-side/
  p.
    For many years client-side JavaScript exploitation has been the focus of
    web application security research - with the advent of JavaScript run on
    the server in recent years, new exploitation research has taken off. As
    the web moved toward ever-increasing use of JavaScript to make sites
    reactive and easier to develop, Server Side JavaScript Injection evolved
    as one method for code execution against the host server.
  p.
    #[a(href="https://nvisium.com/blog/2015/08/27/the-evil-side-of-javascript-server-side/")] nVisium
    has a good write up on how Server Side JavaScript Injection occurs, as
    well as examples on how to exploit web applications using this
    exploitation method.
  p.
    The following form is vulnerable to a Server Side JavaScript Injection.
    Exploit it to read /etc/passwd.
  div
    form(name="search", method="post")
          div.input
              input(type="text", name="query", placeholder="Search...")
          div.actions
              input(type="submit", value="Go")
  p
    //- TODO: Figure out how to properly reroute to index
    a(href="http://localhost:3000") Return to Index

Fix error from missing parenthesis
Fix error from missing parenthesis
