+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: [Interesting]Check this Site out. Cant view the Source. (/showthread.php?tid=3023094)
Pages: Pages
1
2
[Interesting]Check this Site out. Cant view the Source. - Bioblaze Payne - Nov 15, 2012
http://www.x954.com/
Dont know whats up. but give it a Gander, im just sitting back and puzzling at it right now.
* - JohnRonder - Nov 15, 2012
Code
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns='http://www.w3.org/1999/xhtml' xml:lang='en' lang='en'>
<head>
<meta http-equiv='Content-Type' content='text/html; charset=utf-8'/>
<title>Password Protected Site</title>
<style type='text/css'>
body { margin: 60px; font: 12px 'Helvetica Neue', Helvetica, Arial, sans-serif; line-height: 18px; }
body { background: red; color: #fff; }
label { display: block; margin-bottom: 3px; font-weight: bold; }
input[type='password'] { width: 250px; border: none; padding: 4px; font-size: 15px; background: white; }
.button { padding: 5px 10px; display: inline; background: #777; border: none; color: #fff; cursor: pointer;
font-weight: bold; }
.button:hover { background-position: 0 -48px; background: #0c0; }
.button:active { background-position: 0 top; position: relative; top: 1px; padding: 6px 10px 4px; }
</style>
</head>
<body>
<h1>This site is password protected.</h1>
<form name='login' method='post' action=''><p><label>Enter Password</label>
<input id='password' type='password' name='password' value='' /></p>
<p><button type='submit' name='submitter' class='button'>Submit</button></p>
<input type='hidden' name='check' value='' /></form>
<div id='notification'></div>
</body>
</html>Erm, what?
* - VipVince - Nov 15, 2012
Ctrl U I believe you can view the source.
* - Zwift - Nov 15, 2012
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns='http://www.w3.org/1999/xhtml' xml:lang='en' lang='en'>
<head>
<meta http-equiv='Content-Type' content='text/html; charset=utf-8'/>
<title>Password Protected Site</title>
<style type='text/css'>
body { margin: 60px; font: 12px 'Helvetica Neue', Helvetica, Arial, sans-serif; line-height: 18px; }
body { background: red; color: #fff; }
label { display: block; margin-bottom: 3px; font-weight: bold; }
input[type='password'] { width: 250px; border: none; padding: 4px; font-size: 15px; background: white; }
.button { padding: 5px 10px; display: inline; background: #777; border: none; color: #fff; cursor: pointer;
font-weight: bold; }
.button:hover { background-position: 0 -48px; background: #0c0; }
.button:active { background-position: 0 top; position: relative; top: 1px; padding: 6px 10px 4px; }
</style>
</head>
<body>
<h1>This site is password protected.</h1>
<form name='login' method='post' action=''><p><label>Enter Password</label>
<input id='password' type='password' name='password' value='' /></p>
<p><button type='submit' name='submitter' class='button'>Submit</button></p>
<input type='hidden' name='check' value='' /></form>
<div id='notification'></div>
</body>
</html>
* - SIM-1452330 - Nov 15, 2012
Yeah, I could see the source.
Strange rofl...
* - Phizo - Nov 15, 2012
BioblazePayne is specifically talking about after the request, not prior to it.
If you submit the request and then attempt to view the source you should be given the following.
Spoiler (Click to View)
![[Image: 97df46d3b274f4a26555e5b76d777236.png?1352985773]](https://gyazo.com/97df46d3b274f4a26555e5b76d777236.png?1352985773)
* - RyanC - Nov 15, 2012
(Nov 15, 2012 06:24 AM)Phizo Wrote: BioblazePayne is specifically talking about after the request, not prior to it.
If you submit the request and then attempt to view the source you should be given the following.
Spoiler (Click to View)
Spoiler (Click to View) I managed that just fine
* - MajorFail - Nov 15, 2012
Firefox won't show the source after POST unless you hit F5 in the 'view-source' screen. It doesn't seem to cache the server response.
* - amorphos - Nov 15, 2012
Unsure what's to be seen/gained from this site. Nothing strange or unusual about it in fact, pretty dumb considering you could butcher this up using Burpsuite, curl, etc.
Code
Cookie: site_password_count=1
Cache-Control: max-age=0
Content-Type: application/x-www-form-urlencoded
Content-Length: 31
password=$NEW_WORD_ALL_THE_TIME&submitter=&check=Cookie: site_password_count=0 ... So much for 4 attempts
* - xRate - Nov 15, 2012
The site may look for your IP and match it up with blocked IPs after youve tried it 5 times and then return a header() with a 404 page. Not that hard.
* - amorphos - Nov 15, 2012
(Nov 15, 2012 07:36 AM)xRate Wrote: The site may look for your IP and match it up with blocked IPs after youve tried it 5 times and then return a header() with a 404 page. Not that hard.
After about 20 tries doubtful and it would be not only a waste of time considering I could use a proxy, but outright stupid since I could spoof its gateway causing the domain to literally block its gateway from communicating thereby dropping the site altogether. In fact, I could likely get it to drop the net with 0.0.0.0 but that in itself might be too complex for some to understand.
* - xRate - Nov 15, 2012
(Nov 15, 2012 07:43 AM)amorphos Wrote: After about 20 tries doubtful and it would be not only a waste of time considering I could use a proxy, but outright stupid since I could spoof its gateway causing the domain to literally block its gateway from communicating thereby dropping the site altogether. In fact, I could likely get it to drop the net with 0.0.0.0 but that in itself might be too complex for some to understand.Get your point, though I am still unable to reproduce the effect that OP is talking about.
* - kma9090 - Nov 15, 2012
Just click retry to view source:
Code
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns='http://www.w3.org/1999/xhtml' xml:lang='en' lang='en'>
<head>
<meta http-equiv='Content-Type' content='text/html; charset=utf-8'/>
<title>Password Protected Site</title>
<style type='text/css'>
body { margin: 60px; font: 12px 'Helvetica Neue', Helvetica, Arial, sans-serif; line-height: 18px; }
body { background: red; color: #fff; }
label { display: block; margin-bottom: 3px; font-weight: bold; }
input[type='password'] { width: 250px; border: none; padding: 4px; font-size: 15px; background: white; }
.button { padding: 5px 10px; display: inline; background: #777; border: none; color: #fff; cursor: pointer;
font-weight: bold; }
.button:hover { background-position: 0 -48px; background: #0c0; }
.button:active { background-position: 0 top; position: relative; top: 1px; padding: 6px 10px 4px; }
</style>
</head>
<body>
<h1>This site is password protected.</h1>
<div id='notification'>Please contact the owner of this website for help.</div>
</body>
</html>* - dudethatsmyapple - Nov 15, 2012
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns='http://www.w3.org/1999/xhtml' xml:lang='en' lang='en'>
<head>
<meta http-equiv='Content-Type' content='text/html; charset=utf-8'/>
<title>Password Protected Site</title>
<style type='text/css'>
body { margin: 60px; font: 12px 'Helvetica Neue', Helvetica, Arial, sans-serif; line-height: 18px; }
body { background: red; color: #fff; }
label { display: block; margin-bottom: 3px; font-weight: bold; }
input[type='password'] { width: 250px; border: none; padding: 4px; font-size: 15px; background: white; }
.button { padding: 5px 10px; display: inline; background: #777; border: none; color: #fff; cursor: pointer;
font-weight: bold; }
.button:hover { background-position: 0 -48px; background: #0c0; }
.button:active { background-position: 0 top; position: relative; top: 1px; padding: 6px 10px 4px; }
</style>
</head>
<body>
<h1>This site is password protected.</h1>
<form name='login' method='post' action=''><p><label>Enter Password</label>
<input id='password' type='password' name='password' value='' /></p>
<p><button type='submit' name='submitter' class='button'>Submit</button></p>
<input type='hidden' name='check' value='' /></form>
<div id='notification'></div>
</body>
</html>
* - RyanC - Nov 15, 2012
(Nov 15, 2012 07:43 AM)amorphos Wrote: After about 20 tries doubtful and it would be not only a waste of time considering I could use a proxy, but outright stupid since I could spoof its gateway causing the domain to literally block its gateway from communicating thereby dropping the site altogether. In fact, I could likely get it to drop the net with 0.0.0.0 but that in itself might be too complex for some to understand.
Mind explaining how you are going to spoof HTTP requests?