+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: Game Server Attempts (/showthread.php?tid=4684607)
Game Server Attempts - ROPUA - Feb 13, 2015
Note: This is not a thread where I am begging to be spoonfed, I legitimately tried a bunch of methods to crack this username and pass and now I need a bit of assistance or at least a push in the right direction.
I do not truly care about hacking this so much but I like the challenge and it is an interesting experiment for a noob such as myself.
Anyway I mope around this game server with CommView and find that if I put in the source IP in my address bar I get the page to the log in of the admin panel.
Entering this http://46.21.154.203 ---> renders this link to the admin panel--->
(that I cannot post because I am not a str0nk enough user yet, but if you put that IP in your address bar you should get it.)
So I try to bruteforce this with Brutus.
I add the username of the head developer that I know controls this panel and Brutus renders some basic accepted user/pass combos like Admin/academia and a few combos with the head dev's name.
I try all of the combos Brutus recommends, no cigar.
Then I read up on HF about SQL injection and try to find a vulnerability manually. Once again, no cigar.
In what direction should I go with this/what should I do?
* - 0llyy - Feb 14, 2015
If you have tried SQL Vuns manually and you got no ciggy then you can try using a program called Havji, That might come up with something
-0lly
* - Th3-J35t3R - Feb 14, 2015
(Feb 13, 2015 10:14 PM)ROPUA Wrote: Note: This is not a thread where I am begging to be spoonfed, I legitimately tried a bunch of methods to crack this username and pass and now I need a bit of assistance or at least a push in the right direction.The company that owns those servers runs their site on WordPress, probably a vuln in there where you might find some info. Really?! TF2 servers?
I do not truly care about hacking this so much but I like the challenge and it is an interesting experiment for a noob such as myself.
Anyway I mope around this game server with CommView and find that if I put in the source IP in my address bar I get the page to the log in of the admin panel.
Entering this http://46.21.154.203 ---> renders this link to the admin panel--->
(that I cannot post because I am not a str0nk enough user yet, but if you put that IP in your address bar you should get it.)
So I try to bruteforce this with Brutus.
I add the username of the head developer that I know controls this panel and Brutus renders some basic accepted user/pass combos like Admin/academia and a few combos with the head dev's name.
I try all of the combos Brutus recommends, no cigar.
Then I read up on HF about SQL injection and try to find a vulnerability manually. Once again, no cigar.
In what direction should I go with this/what should I do?
* - haxedsh1t - Feb 16, 2015
Try finding other services on that ip. Maybe some of them could be outdated.
* - Viktory - Feb 16, 2015
Find a better wordlist and try bruteforcing again. There's no captcha so it should be easy given you have a decent wordlist.