Skip to main content

Exploiting Software Haking_ATTACK PATTERN - Part 1

Raspberry Pi Hacking

The Raspberry Pi is a credit-card sized computer that plugs into your TV and a keyboard. It’s a capable little PC which can be used for many of the things that your desktop PC does, like
spreadsheets, word-processing and games. It also plays high-definition video. We want to see it being
used by kids all over the world to learn programming.

What are the dimensions?
The Raspberry Pi measures 85.60mm x 53.98mm x 17mm, with a little overlap for the SD card and
connectors which project over the edges. It weighs 45g (Figure 1).

Raspberry Pi Specs – Model B
Processor / Chipset: Broadcom 700 MHz RAM: Installed Size 256 MB Graphics Controller: VideoCore IV Operating System / Software OS Provided: Debian Linux

Tweaking Raspberry Pi’s Performance
Initially  was not planning on covering much hacking the Pi it’s self, but seems that over clocking
the Pi, and some OS modifications can greatly enhance the performance of the Pi. All of the
changes to the pi here will be software based changes, but be forewarned that messing with
CPU settings can result in the death of a Pi if not done properly. Everything in this guide has been
tested , and confirmed to be working on  Pi.

Performing some of these tweaks or modifications can allow you to see a performance boost of
up to 25%. Multiple tips have been cropping up online from cutting down on RAM usage, tuning the
SD card to hacking some bits in the CPU.
















RAM Usage

By simply removing un-needed services and disabling daemons, you can greatly increase performance.

Modifying Startup Services

You will first need to install sysv-rcocnf onto your Pi before you begin. Do so by issuing the following command: sudo apt-get install sysv-rc-conf. Once this has been installed, you can begin disabling un-needed services by issuing the following command: sudo sysv-rc-conf.

Ie: samba, nfs etc..

Most services are safe to disable for normal operation of the Pi. If you know you will not be accessing any windows file shares, samba is safe to disable, same goes for NFS with Linux/Unix shares. If you do not know what it is, it’s best to leave it alone. Once you are done you will be required to run the following command to complete the configuration: dpkg-reconfigure innserv.

Inittab Modifications

By default the Pi will spawn 6 terminals available for use once the Pi boots up. The average use does not need more than one or two at most. We can save some resources by limiting the amount of
terminals spawned down from 6 to 2. To do so, edit the /etc/inittab file by issuing the following command:  vi /etc/inittab. Once the file has been opened, look for lines matching the following (line
51): Table 1. Once the above changes have been made, you can now save and exit the editor.

Disabling console access

Depending how you use your Pi, you can save more resources by disabling console access if you are sure you will not need it. This is useful in cases where you are using your Pi as a Raspbmc media
center or something. To disable the console, you will need to edit the file: /boot/cmdline.txt.
Remove the following line and save the file:

console=ttyAMA0,115200 kgdboc=ttyAMA0,115200

Enabling DASH

Using dash as the system shell will improve the system’s overall performance. Configure dash by
issuing the following command: dpkg-reconfigure dash.
When prompted to use dash as the default system shell, select: <Yes>.

House Keeping

After time the Pi will get full of old update archives etc or maybe even un-used software still left lingering around. To keep things tidy around the Pi, issue the following commands every once in
awhile:

sudo apt-get autoremove
sudo apt-get autoclean

Removing Gnome

If you never plan on using gnome or maybe you are using your Pi as a Raspbmc media center, you can save some more resource by removing: gnome and gvfs. If you are sure you will never use
the two, you can remove them and anything associated with the two by issuing the following commands:

apt-get remove gnome
apt-get remove gvfs
apt-get autoremove

Disk Tuning

Since the Raspberry Pi uses the SDcard for everything, the read and write performance will drop.
Though have no fear as there is a few things we can to minimize the hidden I/O, thus increasing
performance of the SDcard. The good think about these improvements is that most of them are not
based on modifying the kernel of any sort.

Tweaking Syslog

The first step we can take to improve the performance on the SDcard is to minimize the logging and remove unnecessary logs. Edit the syslog file by issuing the following command: vi /etc/rsyslog.conf.









To disable a service from logging, you can put ‘#’ in front of the line.
Once you have disabled the unnecessary log files, you can then restart syslog by issuing the
command: sudo /etc/init.d/rsyslog restart.

Creating partitions aligned with Flash Block

Before creating this partition, you will need to find the erase block size of your SDcard. Most SDcards have a size of 128k, but you should double check your card before proceeding.
Finding out the size is simple using the python script (Listing 1).

Formatting partitions with journaling turned off

Journaling ensures the integrity of the filesystem by keeping a log of the ongoing disk changes.
However, it is known to have a small overhead.Some people with special requirements and workloads can run without a journal and its integrity advantages. In Ext4 the journaling feature can be disabled, which provides a small performance improvement.

WARNING

Make sure all of the data on the SDcard has been backed up before attempting this. DATA LOSS will
occur!

























To disable journaling on the SDcard, issue the following command:

mkfs.ext4 -O ^has_journal -L PiBoot /dev/mmcblk0p1
fsck.ext4 -f /dev/mmcblk0p1

Tweaking Disk Scheduler

To further tweak the disk performance, there is a few more things that can be disabled. The first step
you can do is to tell disk scheduler to enabling the deadline I/O scheduler.
The Deadline scheduler excells at attempting to reduce the latency of any given single I/O for realtime like environments, which makes it perfect for the Pi.
To enable the deadline I/O scheduler, you will need to modify the /boot/cmdline.txt file.

sudo vi /boot/cmdline.txt

Change the file to match the following, by adding elevator=deadline.

dwc_otg.lpm_enable=0 root=/dev/mmcblk0p3 rootfs
type=ext4 elevator=deadline rootwait quiet

You can also increase disk performance by disabling Access Time for files and directories.
You can do so by editing the /boot/cmdline.txt file and editing the rootflags= option to match the
following:

rootflags=data=writeback,commit=120

This can also be enabled permanently with a kernel re-build, but for simplicity sake of the guide we
are using the command line method for enabling these options.

CPU – Over Clocking

Unless you truly understand what you are doing, safely skip this section…

Use This Tweak At Your Own Risk

The CPU on the Pi is quite simple to over clock, you can easily get a 15% performance increase
without even over volting the CPU. Since you are not applying anymore voltage to the CPU, fans or
heat sinks should not be required?

Use This Tweak At Your Own Risk

By default the Raspberry Pi comes with the arm_freq set at 800. If you wish to improve performance
just a bit and hang out on the safe side. Configure your /boot/config.txt file to match the following:

WARNING

While these settings have been tested on my Pi. Your mileage may vary, use at your own risk. Modification of these settings will greatly increase the risk of causing damage to your Pi.










Hacking stuff with the Pi

While there is already an extensive list of documentation and guides for getting up and running with your Pi, there have not been many for how to extend the use of your Pi or how to use your Pi for
hacking other things or projects you may have in mind. In this document we will be mainly focusing
on the GPIO pins of the Raspberry Pi.
The GPIO pins that can be found available on the PCB of the pi will allow you to interface with
external applications via headers on the side of the board. These GPIO pins are very useful for controlling things like LEDS, Motors or reading from switches.
See Figure 2 of the pi, the 26 GPIO pins have been highlighted on the bottom right corner.


























GPIO Introduction

What is GPIO?
General Purpose Input/Output (a.k.a. GPIO) is a generic pin on a chip whose behavior (including
whether it is an input or output pin) can be controlled (programmed) through software.
The Raspberry Pi allows peripherals and expansion boards (such as the upcoming Rpi Gertboard)
to access the CPU by exposing the inputs and outputs.
The production Raspberry Pi board has a 26-pin 2.54 mm (100 mil) expansion header, marked as
P1, arranged in a 2x13 strip. They provide 8 GPIO pins plus access to I²C, SPI, UART), as well as
+3.3 V, +5 V and GND supply lines. Pin one is the pin in the first column and on the bottom row.






















For a complete list of all available pins, see http://elinux.org/RPi_BCM2835_GPIOs.

Raspberry Pi GPIO

The Raspberry Pi has a General Purpose Input/ Output (GPIO) connector and this carries a set of
signals and buses. There are 8 general purpose digital I/O pins – these can be programmed as either
digital outputs or inputs. One of these pins can be designated for PWM output too. Additionally
there is a 2-wire I2C interface and a 4-wire SPI interface (with a 2nd select line, making it 5 pins
in total) and the serial UART with a further 2 pins.
The I2C and SPI interfaces can also be used a general purpose I/O pins when not being used in
their bus modes, and the UART pins can also be used if you reboot with the serial console disabled,
giving a grand total of 8 + 2 + 5 + 2 = 17 I/O pins (Figure 3).
The GPIO header contains 2 rows of pins, with 13 pins on each row as shown above.

Pin Diagram – Names & Alt 0 Functions

Out of the 26 pins that are provided by the GPIO header, 17 pins can be used as inputs or outputs
to external applications. In a Pi’s default state, all of the pins have been configured as inputs except
GPIO pins 14 and 15. These pins are initialised as serial data lines TX & RX, these allow you to connect a terminal for logging in. In order to use these pins as Input or Output pins, they will need
to first be re-configured (Table 2).

Hardware Notes

PIN 2 – Supply through input poly fuse                      GPIO 14 – Boot to Alt 0 ->

GPIO 0 – 1k8 pull up resistor                                      GPIO 15 – Boot to Alt 0 ->

GPIO 1 – 1k8 pull up resistor                                      GPIO 4 – GPCLK0

When starting out, ALWAYS make sure to locate P1 first. This will make locating the pins in proper order much easier. Pin 1 will provide 3.3v (50ma) MAX.









Starting at P1 or Pin 1, you should be able to figure out the other pins.

Other Alternative Functions

GPIO 14 – ALT5 = UART1_TXD                             GPIO 15 – ALT5 = UART1_RXD

GPIO 18 – ALT4 SPI1_CE0_N ALT5 = PWM0       GPIO 23 – ALT3 = SD1_CMD ALT4 =                                                                                                    ARM_RTCK

GPIO 24 – ALT3 = SD1_DATA0                              GPIO 25 – ALT4 = ARM_TCK
 ALT4 = ARM_TDO

GPIO 0 – I2C0_SDA                                                  GPIO 1 – I2C0_SCL           

GPIO 17 – ALT3 = UART0_RTS, ALT5 =                GPIO 21 – ALT5 = GPCLK1                                 UART1_RTS

GPIO 22 – ALT3 = SD1_CLK
ALT4 = ARM_TRST

Notes

• Pin 3 (SDA0) and Pin 5 (SCL0) are preset to be used as an I²C interface. So there are 1.8 kilohm
pulls up resistors on the board for these pins.
• Pin 12 supports PWM.
• It is possible to reconfigure GPIO connector pins P1-7, 15, 16, 18, 22 (chipset GPIOs 4 and 22 to 25) to provide an ARM JTAG interface. However ARM_TMS isn’t available on the GPIO connector (chipset pin 12 or 27 is needed).Chipset pin 27 is available on S5, the CSI camera interface however.

WARNING

Make sure that you are looking at the pins the correct way. Failure to do so could result in a dead Pi!
The Raspberry Pi is a 3.3 volt device. If you attempt to connect to any 5V logic application, Failure
to adhere to this can result in a dead pi!

Example Pi Pin Diagram

Hint: Even number pins are on the inner side of the pi, while the odd number pins reside on the outer
side of the pi (Figure 4).

Power Pins

The GPIO header provides a 5V source on Pin 2 and 3.3V on Pin 1. The 3.3V supply on Pin 1 is
limited to a maximum draw of 50mA. The 5V supply on Pin 2 will draw current directly from the microUSB supply, whatever is left over from the board can be used via this pin. Using a 1A power supply,300mA can be used once the board has drawn it’s required 700mA.

Model A: 1000 mA – 500 mA -> max current draw: 500 mA
Model B: 1000 mA – 700 mA -> max current draw: 300 mA

Warning

Be very careful with the 5V pin.
If you short it to any other P1 pin you may permanently damage your Pi.

Pro Tip: Strip a short piece of insulation from another wire and push it over the 5V pin so you don’t
accidentally touch it with a probe.
The maximum you can draw from the power pin is between: 150-250mA and again this all depends
on what you have currently running, this could be much less. See the link below for more information:http://nathan.chantrell.net/20120610/raspberry-pi-and-i2c-devices-of-different-voltage#f3fuse.

Protecting your pins and your Pi

Before you go connecting stuff up and playing around, make sure you know what you are doing!
Almost all of the GPIO pins located on the header go directly into the Broadcom chip. A simple short circuit or mistake in wiring can result in the quick death of your Pi.

GPIO – Interaction

Having your way with the Pi’s pins…

WiringPi

WiringPi is a Wiring library written in C and should be usable from C++ and many other languages
with suitable wrappers.If you have ever used an Arduino before, you will know they are composed of two things. One is the hardware platform, and the other is the software platform. Part of the software side of things is a tool called Wiring. Wiring is the core of the input and output for the Arduino system.



































































Pin numbering

WiringPi supports both an Arduino style pin numbering scheme which numbers the pins sequentially
from 0 through 16, as well as the Raspberry Pi’s native BCM GPIO pin numbering scheme.

Downloading WiringPi
https://projects.drogon.net/raspberry-pi/wiringpi/download-and-install/.

Special Pin Functions

WiringPi defines 17 pins, but some of them and the functions we can use may potentially cause problems with other parts of the Raspberry Pi Linux system.

• Pins 0 through 7 (GPIO 17, 18, 21, 22, 23, 24,25, 4 respectively): These are safe to use at any time and can be set to input or output with or without the internal pull-up or pull-down resistors enabled.
• PWM: You can change the function of pin 1 (GPIPO 18) to be PWM output, however if you
are currently playing music or using the audio system via the 3.5mm jack socket, then you’ll find one channel of audio PWM coming through the pin! If you are not using the audio at all, (or the audio is going via the HDMI cable), then this pin is free to be used in PWM mode.




• Pins 8 and 9 (GPIO 0 and 1): These are the I2C pins. You may use them for digital IO if you
are not using any I2C drivers which use these pins, however note that they have on-board 1k8 resistors pulling the signals to the 3v3 supply.This feature does make them handy for switch inputs where the switch simply shorts the pin to ground without having to enable the internal pull-up resistors
• Pins 10, 11, 12, 13 and 14 (GPIO 8, 7, 10, 9 and 11 respectively): These are used for the SPI interface. Like the I2C interface, if you are not using it, then you can freely use them for your own purposes. Unlike I2C, these pins do not have any external pull up (or pull down) resistors.
• Pins 15 and 16 (GPIO 14 and 15): These are used by the UART for Tx and Rx respectively.
If you want to use these pins as general purpose I/O pins then you need to make sure that you reboot your Pi with the serial console disabled.See the file /boot/cmdline.txt and edit it appropriately.

Programming Libraries

Controlling the GPIO pin’s using libraries from various programming languages.

Python Library

RPi.GPIO Python library – http://pypi.python.org/pypi/RPi.GPIO. See Listing 2 for example.

Java Library

RPi-GPIO-Java – http://code.google.com/p/rpigpio-java/. See Listing 3 for example.

C

Using the bcm2835 Library http://www.open.com.au/mikem/bcm2835. See Listing 4 for example.

Perl

Using the bcm2835 library and Device::BCM2835 module from CPAN. http://www.open.com.au/
mikem/bcm2835. http://search.cpan.org/~mikem/Device-BCM2835-1.0/lib/Device/BCM2835.pm.
See Listing 5 for example.

C#

RaspberryPiDotNet library – https://github.com/cypherkey/RaspberryPi.Net/. See Listing 6 for example.

Ruby

WiringPi Ruby Gem – http://pi.gadgetoid.co.uk/post/015-wiringpi-now-with-serial. See Listing 7
for example.

Shell Script

See Listing 8 for example.

GPIO – External Applications
Interfacing With a Teensy Kit

Teensy Pinout: http://www.pjrc.com/teensy/pinout.html. Logic Level Converter: https://www.sparkfun.com/products/8745? (Figure 5).

UART/Serial

Using a logic level converter you can work with the UART / Serial interface to allow a Pi to communicate with a Teensie board. The TX from the teensy should go to the RX on the Raspberry Pi, vice versa.To connect up the Pi, connect up the following GPIOs to the corresponding pins on the logic level converter.


You should be able to purchase a logic level converter for cheap, usually under 3$.

Interfacing with LCD Displays

Hooking the Pi up to a 2x16 HD44780 compatible LCD via GPIO (Figure 6). Another cool thing to control with your Pi is a LCD screen. In this example will be using a HD55780 compatible LCD display. These can be found pretty cheap on ebay for a few dollars. Double check the data sheet for your LCD as pins may vary from  vendor to vendor (Figure 7).

Wiring things up to the LCD

Normally a HD44780 LCD would require 8 data lines to provide data to bits 0-7. However you can
set this device to operate in “4 bit” mode which will then allow you to send data in two chunks or 4 bits. This is handy as it reduces the amount of required GPIO connections from the Pi, leaving them free for other things.
The HD44780 LCD will also allow you to control the brightness of the LCD by adjusting the voltage
flowing to VO. The voltage must be between the range of 0 and 5volts. In the above example, VO
has been connected into ground. Using a potentiometer, you could add an adjustable knob to control
the brightness of the LCD screen in real time (Figure 8).

NOTE(s):

• pin numbers are referring to pins on the Raspberry pi, where as names refer to the image on the left.
• LEDA provides 5 volts to the backlight LED of the LCD. HD44780 compatible devices should
operate between 2.2 and 5.5 volts. LEDA can be directly connected to the 5v source.



• The RW pin allows you to set the LCD in read or write mode, for this example we want to send data to the LCD, but not allow the LCD to send data back to the Pi. The reason for this is that the Pi will not take more than 5V of input on the GPIO header. Doing so may result in damage to your Pi. Tying the RW pin into ground will ensure that the LCD will NOT attempt to pull the lines over 5volts.

Once you have everything connected up properly, power on and boot up your Pi. If everything was
done correctly thus far, the LCD screen should now power on and show either one or two rows of
boxes. These boxes will remain until the LCD has been initialized for the first time (Figure 9).

Using Python to control the LCD

Now that everything looks to be up and running, you can now control what is displayed onto the
screen.
Using any of the programming language libraries discussed earlier, as an example we will be using
some simple python code with the RPi.GPIO library. Since we will be accessing the GPIO interface,
you will need to run python as root when running the code. not the author of this code, just hacked
it up a bit to better fit the document. The original code was written by: Matt Hawkins (Listing 9).
If you get an error like “RPi.GPIO.SetupException: No access to /dev/mem.” Make sure you are
running python as root: sudo python testlcd.py.If everything went well, you should first see “Raspberry Pi Model B” appear, shortly after “magikh0e, DARPAnet” should appear (Figure 10).
Common issues  have ran into…
Only see squares across the LCD: Double check all of your connections are going to the right place, and ensure good connectivity with the LCD.
Weir characters appearing: Check the connectivity on the LCD.


MCP23017 I2C I/O Expander

Not enough GPIO pins for you, well not a problem if you have a 16bit MCP23017 I2C I/O Expander
kicking around. This will also work with the 8bit model, MCP23008. They both also come in
a DIP form, so using them build your own expansion board for the Pi should be fairly simple. If not
they are simple enough to use on any breadboard as well. The data sheet for the 16bit version of the
MCP23017 I2C I/O Expander can be found here: http://ww1.microchip.com/downloads/en/Device
Doc/21952b.pdf.
The 16bit version of the MCP23017 chip has 28 pins that will give you a total of 16 pins that can
be used. These pins can be used as either inputs or outputs. Up to 8 of these pins can be used on 1
I2C bus, thus giving you a lot more I/O than the Pi has built in. The best thing about this chip is that
you can reduce the risk of damaging your Pi each pin has a maximum of 25mA for input or output.
The expander can also be placed away from the Pi its self, and connecting up using only 4 wires.
If space is a concern, go with the 8bit MCP23008 model.

Required drivers and software

Before you will be able to control the expander, you will require some drivers and tools first. Keep
in mind that the work being done on the I2C drivers are still in pretty early stages. Your Pi will need
to be running a kernel with the bitbanging driver, or have the driver available for the kernel you are
currently running.
After verifying you have a kernel with the bitbanging driver enabled, you will need to install the i2ctools package by issuing the following command:

sudo apt-get install i2c-tools

The i2c-tools package will give us the ability to scan the I2C bus and sending values to I2C addresses
and registers using command line tools.

Connecting the expander to the Pi

Now that you have verified all the proper software is in place, you can now wire the expander into the Pi. Using the chart below connect up the pins from the MCP23017 to the pins on your Pi accordingly (Figure 11).

Notes:

PIN 9: This can be connected to the Pi’s 5v source, or any external source up to 5.5volts.
PINS 15(A0), 16(A1), 17(A2): Setting these pins to ground selects the I2C address as 0×20, other
combinations can set a different address. See data sheet.
PIN 18: Setting this pin to Vcc turns the expander on.

Testing the Pi and Expander communication

Once everything has been connected and verified. You can now test your Pi’s communication with the expander you have just connected.

I2cdetect –y 0

If everything is happy, you should see an ASCII representation of a table with 20 in the first column
on the row marked 20. This will show that there is something there with an I2C address of
0x20. As we expect.

Controlling the MCP23017

As you read in the data sheet for the MCP23017, the I/O pins are laid out in 2 banks. A and B and
each bank is controlled together. In order to set a pin as an input or output, you will need to send
a hex value to the correct register. You can find this in Table 1.4 of the datasheet linked above.
IODIRA (0x00) will sets the input/output state for bank A and IODIRB (0x01) for bank B. In order
to change a pin to be an input, you need to set each of the 8bits to 1. To setup the pin as an output,
each bit will need to be set to 0. Keep in mind in a default state all of the pins are setup to be
inputs.
So if you wish to set pins 0,1, and 7 to be inputs and the rest of the pins as outputs. You would set
10000011 in binary or 0x83 in hex. To set the entire bank as outputs, you can simply use 0x00.
Once the pins have been configures as inputs/outputs, you can turn them on or off by sending a
hex value to the register for the particular bank you wish to control. 0x12 for bank A, 0x13 for bank B.
As always 1 is on, 0 is off, using the same form as above. So if you wish to turn pin 0 on, you will
send 00000001 as binary, or 0x01 as hex.

I2cset examples

Set all of bank A to be outputs: i2cset –y 0 0x20
0x00 0x00
Set GPA0 as on: i2cset –y 0 0x20 0x12 0x01
Set GPA0 as off: i2cset –y 0 0x20 0x12 0x00
i2cset command format: i2cset i2-cbus i2c-address
i2c-register value

Popular posts from this blog

Haking On Demand_WireShark - Part 5

Detect/Analyze Scanning Traffic Using Wireshark “Wireshark”, the world’s most popular Network Protocol Analyzer is a multipurpose tool. It can be used as a Packet Sniffer, Network Analyser, Protocol Analyser & Forensic tool. Through this article my focus is on how to use Wireshark to detect/analyze any scanning & suspect traffic. Let’s start with Scanning first. As a thief studies surroundings before stealing something from a target, similarly attackers or hackers also perform foot printing and scanning before the actual attack. In this phase, they want to collect all possible information about the target so that they can plan their attack accordingly. If we talk about scanning here they want to collect details like: • Which IP addresses are in use? • Which port/services are active on those IPs? • Which platform (Operating System) is in use? • What are the vulnerabilities & other similar kinds of information. • Now moving to some popular scan methods and ho

Bypassing Web Application Firewall Part - 2

WAF Bypassing with SQL Injection HTTP Parameter Pollution & Encoding Techniques HTTP Parameter Pollution is an attack where we have the ability to override or add HTTP GET/POST parameters by injecting string delimiters. HPP can be distinguished in two categories, client-side and server-side, and the exploitation of HPP can result in the following outcomes:  •Override existing hardcoded HTTP parameters  •Modify the application behaviors   •Access and potentially exploit uncontrollable variables  • Bypass input validation checkpoints and WAF rules HTTP Parameter Pollution – HPP   WAFs, which is the topic of interest, many times perform query string parsing before applying the filters to this string. This may result in the execution of a payload that an HTTP request can carry. Some WAFs analyze only one parameter from the string of the request, most of the times the first or the last, which may result in a bypass of the WAF filters, and execution of the payload in the server.  Let’s e

Bypassing Web Application Firewall Part - 4

Securing WAF and Conclusion DOM Based XSS DOM based XSS is another type of XSS that is also used widely, and we didn’t discuss it in module 3. The DOM, or Document Object Model, is the structural format used to represent documents in a browser. The DOM enables dynamic scripts such as JavaScript to reference components of the document such as a form field or a session cookie, and it is also a security feature that limits scripts on different domains from obtaining cookies for other domains. Now, the XSS attacks based on this is when the payload that we inject is executed as a result of modifying the DOM environment in the victim’s browser, so that the code runs in an unexpected way. By this we mean that in contrast with the other two attacks, here the page that the victim sees does not change, but the injected code is executed differently because of the modifications that have been done in the DOM environment, that we said earlier. In the other XSS attacks, we saw the injected code was