[LGhost]

Hi guys, this is my first tutorial here. Depending on the feedback I get, I'm willing to do a series on the hackthissite missions (like a “Road To Hacker” :D )
I do not intend to make a "book of solutions" but try to explain in more detail each mission.

It should be noted that sometimes there may be more than one solution for the same problem. All the solutions described here were the ones that I performed.

Hope you all enjoy :D

Requirements for this tutorial:
Firefox (any other browser will work but the instructions I will give is for Firefox).
Firebug for Firefox

What you will learn:
- Inspect and Change HTML on a webpage.
- JavaScript Injection.

Basic 1
For this one you’ll need to know HTML. HTML is a very simple markup language, if you don’t know HTML then you’ll first need to learn HTML in order to proceed…
This one is very very simple (that’s why it’s called “Level 1(the idiot test)”). All you have to do is right click on the password field and “Inspect Element”. You’ll quickly realize that there is a comment on top of the form:

Code

[b]<!--[/b] the first few levels are extremely easy: password is 654d89be -->

And there you have the solution!

Basic 2
Well, this one you need to know… nothing! I think that if you read carefully the instructions you don’t even need to read this solution :D … you’ll see there: “he neglected to upload the password file”… and that means? Yeah, no password.

Basic 3
Again, like in Basic 1, if you “Inspect Element” on the password field you’ll see near an hidden form field:

Code

<input type="hidden" value="password.php" name="file">

Well that “password.php” is interesting. Let’s see what’s there. If you navigate to ".../missions/basic/3/password.php" you’ll find some digits. If you copy that to the password field and submit you’ll see that that’s the password we needed :D

Basic 4

Now we have a button to send the password to Sam if he forgets it. That's cool... but we want it to send the password to us right? :D
Still with our HTML skills let's "Inspect Element" on that button... Right away we can see that there is (again) an hidden form field. This time the value is Sams email address. Let's "inject" our email address instead. For that we just need to double click Sams email address, write ours and hit enter. Now we just need to click the button "Send password to Sam" and we will get an email with the password :D

Basic 5

In this one you can use the same method as in Basic 4, it will work just fine.
But the intention is to inject javascript to send the email to us. (You will need to know javascript in order to proceed this "road to hacker")
In Firefox we will need an add-on called FireBug. After installing that add-on we then will right click the "Send password to Sam" button and we will get a new option called "Inspect Element with Firebug", click that.
So... To inject javascript we simple need to go to the console tab in firebug and simply type the command to inject. In this case

Code

document.forms[0].elements[0].value='YOUREMAIL';

Let's break it down. If you know javascript you may know what that code does if you don't understand very well i'll explain... In the document search for the first form (forms[0]) and the first element of that form (elements[0] - the <input type="hidden"> in this case) and change their value to YOUREMAIL.
Simply as that (:

Basic 6

In Basic 6 the password is encrypted but we are in luck because the "encryption system is publically available". Let's try to insert "aaaaa" and click "encrypt" just to test. Ok, we get "abcde". So we know that it adds the position of the character to the character itself (starting at 0). So a+0=a, a+1=b, and so on... To make it easier go to the asciitable website (it really really helps).

The End...
As you can see I don't intend to give the solution but TEACH the solution. I think that it's better that you go by your own rather than just copy paste the solution (:
Hope you guys like this idea to use hackthissite as a learning process to hack (:

In tutorial 2 we will get more advanced as I will teach SSI (Server Side Includes), Directory Transversal, Cookie Modification, some linux commands and some web server basics. See you there ;)

Note: I will post images and links as soon as I get 50 posts (:

[abratar]

i dont see any links to each basic ... how are we supposed to do it then?

[LGhost]

thanks for this tutorial.

You're welcome, hope it helps someone :D
Tutorial 2 (basic 7-11) will be better with more advanced techniques (:

[Zeroxal]

Wow, thanks! Very good tutorial! Does this work on other sites too? Not want to hack google etc, but other small forums?

[LGhost]

Wow, thanks! Very good tutorial! Does this work on other sites too? Not want to hack google etc, but other small forums?

This is a very basic tutorial like a starting guide to hack. What I mean is that this techniques are very basic and limited. But yes if the website has that vulns then it will work (:

[4158996621556]

I used to love that website, really fun.
I managed to beat most of the basics and 3 realistics, but that one basic 5.... thanks!

[LGhost]

I used to love that website, really fun.
I managed to beat most of the basics and 3 realistics, but that one basic 5.... thanks!

You're welcome :D Really appreciate the feedback (:
Yeah hackthissite.org and hellboundhackers.org are very cool for practice and for starters (:

[5chn4pp]

You can paste links like this

www.pastebin.com

pastebin.com

just dont include the www and your good to go.

[LGhost]

just dont include the www and your good to go.

Yes but now unfortunately i'm not able to edit my thread because i'm not l33t /:

[LGhost]

Tutorial 2 and 3 is available:

[TUT][HackThisSite][2] Basic Missions 7-9 (Linux Commands, SSI, Directory Traversal)
[TUT][HackThisSite][3] Basic Missions 10-11 (Cookie Modification, Web Servers)