May 10, 2015 10:05 AM
(This post was last modified: May 11, 2015 08:32 AM by LGhost.)
Welcome back! If you haven't seen the last series you can find them here:
[TUT][HackThisSite][RoadToHacker][1] Basic Missions 1-6
[TUT][HackThisSite][2] Basic Missions 7-9 (Linux Commands, SSI, Directory Traversal)
Basic 10
In this mission we don't get instructions, so we have to explore. In the HTML there is nothing wrong and nothing that we can take advantage of. Now I will introduce you to a new technique called "Cookie Manipulation". It uses Javascript Injection to view and change cookies on a webpage. This is a good introduction to cookies and some basic Injections. If you read that introduction/tutorial you'll be good to go (:
Let's right click on the password field and "Inspect Element with Firebug". Firebug makes it easy to view and edit cookies, all you have to do is go to the "Cookies" tab and there you have all the cookies the website is using :D Now take a look to all of them.
[img]http://snag.gy/Vs5Kk.jpg[/img]
That "level10_authorized" seems interesting... but... wait... the value is "no"? wtf? I want it to be "yes" ofc :D Let's right click it, click on "edit" and on the value write "yes".
[img]http://snag.gy/kIqIK.jpg[/img]
Now just click on the submit button and voilá !
... But... What if I don't want to use Firebug or I'm using another browser? Then you can do it using a simple javascript injection, like the ones on the introduction/tutorial I showed you early. This is how you view and edit the cookie manually:
1º To view the cookies used by the website use this javascript injection:
And you'll get:
[img]http://snag.gy/fC1wr.jpg[/img]
2º To edit the cookie use this:
Now you can just click the "submit" button (;
Basic 11
This time we will talk about Apache. As you can see Sam has decided to make a music website. As you may already realized, each time you refresh the page you get a new song name. Let's search for them on google to see if they have something in common.
Well they're all from Elton John.
This mission is a little complicated because it's more about logic and nowadays music websites don't really work like this but... How do you think the music should be organized?
Don't know if you answered the same, but music normally are organized by their performers first letter. And then you will have all the singers with "E" on their first letters name. Let's try to see if and "e" folder exists for Elton John. Going to https://www.hackthissite.org/missions/basic/11/e/ you can see that it exists. Follow the path till the last folder and you'll get a link like this:
https://www.hackthissite.org/missions/ba...e/l/t/o/n/
Now, you look to the folder structure and it's empty... So... WTF? ... Well, it's not really empty, Apache has a file named .htaccess which is a web server configuration file that may contain useful information (if it's not read protected from unauthorized users). Let's see if that file (.htaccess) exists on this folder... Yes, we can see that it exists and we have access to it:
[img]http://snag.gy/Xiw2K.jpg[/img]
That's why we couldn't see any files in the directory! He's not indexing, he's ignoring the files ("IndexIgnore"). But we can see that there's a file named "DaAnswer", let's see what is in it:
[img]http://snag.gy/0iBMX.jpg[/img]
True, the answer is: "right here" xD But... where is the password field? ... The instructions said that we needed to know Apache to go on... Apache is a web server... Web servers normally have an "index.*" page. If it will have a form (for the password field) then it's probably "index.php". Let's see... Let's type "index.php" on the end of the mission link, like this:
And voilá! there's the form :D After you type the password you will have a "Go on" button 🎉
This one concludes the "Basic Missions" hope you enjoyed and if you liked this "Basic Series" and want me to continue let me know 👍
[TUT][HackThisSite][RoadToHacker][1] Basic Missions 1-6
[TUT][HackThisSite][2] Basic Missions 7-9 (Linux Commands, SSI, Directory Traversal)
Basic 10
In this mission we don't get instructions, so we have to explore. In the HTML there is nothing wrong and nothing that we can take advantage of. Now I will introduce you to a new technique called "Cookie Manipulation". It uses Javascript Injection to view and change cookies on a webpage. This is a good introduction to cookies and some basic Injections. If you read that introduction/tutorial you'll be good to go (:
Let's right click on the password field and "Inspect Element with Firebug". Firebug makes it easy to view and edit cookies, all you have to do is go to the "Cookies" tab and there you have all the cookies the website is using :D Now take a look to all of them.
[img]http://snag.gy/Vs5Kk.jpg[/img]
That "level10_authorized" seems interesting... but... wait... the value is "no"? wtf? I want it to be "yes" ofc :D Let's right click it, click on "edit" and on the value write "yes".
[img]http://snag.gy/kIqIK.jpg[/img]
Now just click on the submit button and voilá !
... But... What if I don't want to use Firebug or I'm using another browser? Then you can do it using a simple javascript injection, like the ones on the introduction/tutorial I showed you early. This is how you view and edit the cookie manually:
1º To view the cookies used by the website use this javascript injection:
Code
javascript:document.write(document.cookie);And you'll get:
[img]http://snag.gy/fC1wr.jpg[/img]
2º To edit the cookie use this:
Code
javascript:void(document.cookie="level10_authorized=yes");Now you can just click the "submit" button (;
Basic 11
This time we will talk about Apache. As you can see Sam has decided to make a music website. As you may already realized, each time you refresh the page you get a new song name. Let's search for them on google to see if they have something in common.
Well they're all from Elton John.
This mission is a little complicated because it's more about logic and nowadays music websites don't really work like this but... How do you think the music should be organized?
Don't know if you answered the same, but music normally are organized by their performers first letter. And then you will have all the singers with "E" on their first letters name. Let's try to see if and "e" folder exists for Elton John. Going to https://www.hackthissite.org/missions/basic/11/e/ you can see that it exists. Follow the path till the last folder and you'll get a link like this:
https://www.hackthissite.org/missions/ba...e/l/t/o/n/
Now, you look to the folder structure and it's empty... So... WTF? ... Well, it's not really empty, Apache has a file named .htaccess which is a web server configuration file that may contain useful information (if it's not read protected from unauthorized users). Let's see if that file (.htaccess) exists on this folder... Yes, we can see that it exists and we have access to it:
[img]http://snag.gy/Xiw2K.jpg[/img]
That's why we couldn't see any files in the directory! He's not indexing, he's ignoring the files ("IndexIgnore"). But we can see that there's a file named "DaAnswer", let's see what is in it:
[img]http://snag.gy/0iBMX.jpg[/img]
True, the answer is: "right here" xD But... where is the password field? ... The instructions said that we needed to know Apache to go on... Apache is a web server... Web servers normally have an "index.*" page. If it will have a form (for the password field) then it's probably "index.php". Let's see... Let's type "index.php" on the end of the mission link, like this:
Code
https://www.hackthissite.org/missions/basic/11/index.phpAnd voilá! there's the form :D After you type the password you will have a "Go on" button 🎉
This one concludes the "Basic Missions" hope you enjoyed and if you liked this "Basic Series" and want me to continue let me know 👍
