[Bioblaze Payne]

http://www.x954.com/

Dont know whats up. but give it a Gander, im just sitting back and puzzling at it right now.

[JohnRonder]

Code

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns='http://www.w3.org/1999/xhtml' xml:lang='en' lang='en'>
<head>
<meta http-equiv='Content-Type' content='text/html; charset=utf-8'/>
<title>Password Protected Site</title>
<style type='text/css'>
body { margin: 60px; font: 12px 'Helvetica Neue', Helvetica, Arial, sans-serif; line-height: 18px; }
body { background: red; color: #fff; }
label { display: block; margin-bottom: 3px; font-weight: bold; }
input[type='password'] { width: 250px; border: none; padding: 4px; font-size: 15px; background: white; }
.button { padding: 5px 10px; display: inline; background: #777; border: none; color: #fff; cursor: pointer;
font-weight: bold; }
.button:hover { background-position: 0 -48px; background: #0c0; }
.button:active { background-position: 0 top; position: relative; top: 1px; padding: 6px 10px 4px; }
</style>
</head>
<body>
<h1>This site is password protected.</h1>
<form name='login' method='post' action=''><p><label>Enter Password</label>
<input id='password' type='password' name='password' value='' /></p>
<p><button type='submit' name='submitter' class='button'>Submit</button></p>
<input type='hidden' name='check' value='' /></form>
<div id='notification'></div>
</body>
</html>

Erm, what?

[VipVince]

Ctrl U I believe you can view the source.

[Zwift]

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns='http://www.w3.org/1999/xhtml' xml:lang='en' lang='en'>
<head>
<meta http-equiv='Content-Type' content='text/html; charset=utf-8'/>
<title>Password Protected Site</title>
<style type='text/css'>
body { margin: 60px; font: 12px 'Helvetica Neue', Helvetica, Arial, sans-serif; line-height: 18px; }
body { background: red; color: #fff; }
label { display: block; margin-bottom: 3px; font-weight: bold; }
input[type='password'] { width: 250px; border: none; padding: 4px; font-size: 15px; background: white; }
.button { padding: 5px 10px; display: inline; background: #777; border: none; color: #fff; cursor: pointer;
font-weight: bold; }
.button:hover { background-position: 0 -48px; background: #0c0; }
.button:active { background-position: 0 top; position: relative; top: 1px; padding: 6px 10px 4px; }
</style>
</head>
<body>
<h1>This site is password protected.</h1>
<form name='login' method='post' action=''><p><label>Enter Password</label>
<input id='password' type='password' name='password' value='' /></p>
<p><button type='submit' name='submitter' class='button'>Submit</button></p>
<input type='hidden' name='check' value='' /></form>
<div id='notification'></div>
</body>
</html>

[SIM-1452330]

Yeah, I could see the source.

Strange rofl...

[Phizo]

BioblazePayne is specifically talking about after the request, not prior to it.
If you submit the request and then attempt to view the source you should be given the following.

Spoiler (Click to View)

[RyanC]

BioblazePayne is specifically talking about after the request, not prior to it.
If you submit the request and then attempt to view the source you should be given the following.

Spoiler (Click to View)

Spoiler (Click to View)

Code

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns='http://www.w3.org/1999/xhtml' xml:lang='en' lang='en'>
<head>
<meta http-equiv='Content-Type' content='text/html; charset=utf-8'/>
<title>Password Protected Site</title>
<style type='text/css'>
body { margin: 60px; font: 12px 'Helvetica Neue', Helvetica, Arial, sans-serif; line-height: 18px; }
body { background: red; color: #fff; }
label { display: block; margin-bottom: 3px; font-weight: bold; }
input[type='password'] { width: 250px; border: none; padding: 4px; font-size: 15px; background: white; }
.button { padding: 5px 10px; display: inline; background: #777; border: none; color: #fff; cursor: pointer;
font-weight: bold; }
.button:hover { background-position: 0 -48px; background: #0c0; }
.button:active { background-position: 0 top; position: relative; top: 1px; padding: 6px 10px 4px; }
</style>
</head>
<body>
<h1>This site is password protected.</h1>
<form name='login' method='post' action=''><p><label>Enter Password</label>
<input id='password' type='password' name='password' value='' /></p>
<p><button type='submit' name='submitter' class='button'>Submit</button></p>

<input type='hidden' name='check' value='' /></form>
<div id='notification'>Wrong password - you have 3 attempts left.</div>
</body>
</html>

I managed that just fine

[MajorFail]

Firefox won't show the source after POST unless you hit F5 in the 'view-source' screen. It doesn't seem to cache the server response.

[amorphos]

Unsure what's to be seen/gained from this site. Nothing strange or unusual about it in fact, pretty dumb considering you could butcher this up using Burpsuite, curl, etc.

Code

Cookie: site_password_count=1
Cache-Control: max-age=0
Content-Type: application/x-www-form-urlencoded
Content-Length: 31
password=$NEW_WORD_ALL_THE_TIME&submitter=&check=

Cookie: site_password_count=0 ... So much for 4 attempts

[xRate]

The site may look for your IP and match it up with blocked IPs after youve tried it 5 times and then return a header() with a 404 page. Not that hard.

[amorphos]

The site may look for your IP and match it up with blocked IPs after youve tried it 5 times and then return a header() with a 404 page. Not that hard.

After about 20 tries doubtful and it would be not only a waste of time considering I could use a proxy, but outright stupid since I could spoof its gateway causing the domain to literally block its gateway from communicating thereby dropping the site altogether. In fact, I could likely get it to drop the net with 0.0.0.0 but that in itself might be too complex for some to understand.

[xRate]

After about 20 tries doubtful and it would be not only a waste of time considering I could use a proxy, but outright stupid since I could spoof its gateway causing the domain to literally block its gateway from communicating thereby dropping the site altogether. In fact, I could likely get it to drop the net with 0.0.0.0 but that in itself might be too complex for some to understand.

Get your point, though I am still unable to reproduce the effect that OP is talking about.

[kma9090]

Just click retry to view source:

Code

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns='http://www.w3.org/1999/xhtml' xml:lang='en' lang='en'>
<head>
<meta http-equiv='Content-Type' content='text/html; charset=utf-8'/>
<title>Password Protected Site</title>
<style type='text/css'>
body { margin: 60px; font: 12px 'Helvetica Neue', Helvetica, Arial, sans-serif; line-height: 18px; }
body { background: red; color: #fff; }
label { display: block; margin-bottom: 3px; font-weight: bold; }
input[type='password'] { width: 250px; border: none; padding: 4px; font-size: 15px; background: white; }
.button { padding: 5px 10px; display: inline; background: #777; border: none; color: #fff; cursor: pointer;
font-weight: bold; }
.button:hover { background-position: 0 -48px; background: #0c0; }
.button:active { background-position: 0 top; position: relative; top: 1px; padding: 6px 10px 4px; }
</style>
</head>
<body>
<h1>This site is password protected.</h1>

<div id='notification'>Please contact the owner of this website for help.</div>
</body>
</html>

[dudethatsmyapple]

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns='http://www.w3.org/1999/xhtml' xml:lang='en' lang='en'>
<head>
<meta http-equiv='Content-Type' content='text/html; charset=utf-8'/>
<title>Password Protected Site</title>
<style type='text/css'>
body { margin: 60px; font: 12px 'Helvetica Neue', Helvetica, Arial, sans-serif; line-height: 18px; }
body { background: red; color: #fff; }
label { display: block; margin-bottom: 3px; font-weight: bold; }
input[type='password'] { width: 250px; border: none; padding: 4px; font-size: 15px; background: white; }
.button { padding: 5px 10px; display: inline; background: #777; border: none; color: #fff; cursor: pointer;
font-weight: bold; }
.button:hover { background-position: 0 -48px; background: #0c0; }
.button:active { background-position: 0 top; position: relative; top: 1px; padding: 6px 10px 4px; }
</style>
</head>
<body>
<h1>This site is password protected.</h1>
<form name='login' method='post' action=''><p><label>Enter Password</label>
<input id='password' type='password' name='password' value='' /></p>
<p><button type='submit' name='submitter' class='button'>Submit</button></p>
<input type='hidden' name='check' value='' /></form>
<div id='notification'></div>
</body>
</html>

[RyanC]

After about 20 tries doubtful and it would be not only a waste of time considering I could use a proxy, but outright stupid since I could spoof its gateway causing the domain to literally block its gateway from communicating thereby dropping the site altogether. In fact, I could likely get it to drop the net with 0.0.0.0 but that in itself might be too complex for some to understand.

Mind explaining how you are going to spoof HTTP requests?