hackthissite.org

[ice_531]

www.hackthissite.org

See how far you can get and post level you got to

i'm currently on level6 - basic web hacking

[ice_531]

There are also some neat programming tasks

[NoteMe]

Maintenance:
Down for restoring the Ch40Z


try2hack.nl is also a good site for this...

[ice_531]

yep use to use try2hack.nl , outgrew it though, and moved on to hackedbox.com ( i think thats correct url )

[timeshifter]

Well, I made it past level 1 easy enough... Now I feel stupid being stuck on 2...

[timeshifter]

Never mind... i really do feel stupid for not getting that one..

[ice_531]

ya i was on level 2 for like 5 minutes til i went back and reread

[timeshifter]

It only says I'll be hated if I go running for answers on level 1, so how do I find the password on level 3? I don't want to know what it is, just where to find it.


P.S.: I'm not a hacker... obviously...

[wossname]

It only says I'll be hated if I go running for answers on level 1, so how do I find the password on level 3? I don't want to know what it is, just where to find it.


P.S.: I'm not a hacker... obviously...

(Knowing what password is) == (Knowing where to find password)

[wossname]

How stupid do you have to be to register yourself with a static IP on that site?

[timeshifter]

They want to know where you are hackthissite.org-ing from.

[ice_531]

level 3 ermm if i remember correctly... if u view source and snoop a bit you'll see another page where a password.php file might be

level 4 - a little harder..u gotta find in a script sams email and change it to urs so u can get the pwd emailed to u

level 5 - a little more harder lol this time he has put a little bit of protection in his email script..so u have to modify a few urls n stuff to get the pwd sent to u correctly

[davebat]

how do u do level 5

[wossname]

I got told off for webcamming the admin password yesterday (the webcam software crashed and started displaying the video onscreen rather than dumping it to an AVI, the admin wasn't impressed. If I want to keep my job I have to promise not to be a 133t hax0r any more

teh suxorz.

[vbgamer45]

I had all the challenges beat at the old hackthissite.org version 2

The realistic missons are probably the best part. A good portion of those deal with SQL injection.

You will enjoy the application challenges most of them are made in VB
In fact all the applications are made in some version of Basic expect two or three which are in made in C++.

[mudfish]

.org

It is the government!
Most likely the USA!

I do not hack!
Do not want to start!
But Yall have fun!

The 1 thing I do know about hacking is do not get traced!
You got to get into the phone company first!

[vbgamer45]

nah the site is clean. I know the person who created it, me and him where in highschool together.

[Glitch0079]

Whats the deal with the image verification when you try to register with hackthissite.org? every time i try to register, the image in the box won't show up. is this a test or an error? if you can help, please post

THANKS

[ice_531]

what browser are you using?

works fine for me in FF. Dunno about any errors that might occur using other browsers besides IE and FF.

[Jacob Roman]

Network Security Sam set up a password protection script. He made it load the real password from an unencrypted text file and compare it to the password the user enters. However, he neglected to upload the password file...

What kind of comparison? And, Or, Xor...?

[ice_531]

tis alot easier than your thinking lol

What could he compare if he forgot to upload the password file

[Jacob Roman]

Do you compare the password that was in the page source on Level 1 to your user password at all?

I don't get it!

[ice_531]

want me to tell you ? or what


heres alittle more info:

If you can't compare a textbox for a password, then doyou need to worry about knowing a password?

[Jacob Roman]

Whoh! Thanks dude.

So if he forgets to upload it, then there is no password! How funny is that.

[Jacob Roman]

Yeah, how funny is that...

This time Network Security Sam remembered to upload the password file, but there were deeper problems than that.

[ice_531]

[Jacob Roman]

Where is the url on the file password.php?

I saw that file in the page source.

[tr333]

password.php goes at end of the mission4 url instead of index.php

what urls have to be changed for level 5?
can't seem to get past it.

[ice_531]

which ones you on?

you on the one where "Sam" has the pwd emailed to himself? or the ones jus before that....the ones before that you just have to go to the url + /password.php and then next one you gotta do a lil more by saving the page as n editing the page n url inside the source n then run your page to get it to work... ( if i remember correctly )

[tr333]

i passed level 4 where you get the password e-mailed to yourself.
im stuck on level 5 where "the e-mail program is a little more secure".

[ice_531]

ah, that one took me awhile i do believe.

Basically, follow the same steps you did before when you emailed to yourself but ( i went back and redid them all ) except i saved everything i did in level 4 so that i could compare any changes there were with the source to the page containing the email. You should be able to find what else you need to change to get the email sent to you

[tr333]

thanks for the help
i will try it out

[tr333]

i tried changing a few values and got the message "Referrer Error: Please Check Referer"

i might have changed the wrong values...

EDIT: the only values that change between level4 page and level5 page seem to be the page refernces down the bottom from 5 to 6, and a number in the js page reference at the top

[Glitch0079]

hey can any body help me, I'm suck on mission 4 in hackthissite.org. I veiwed the source and changed the email to mine but when i open the page and click on the buttom it just says can't find page. can anyone give me some hints or something?

THANK

[NeXtDaY]

Hi Guys,


I am stuck in level5 i was tring to change the code but i couldn't . anyone here has idea about what to do and where?

thanks

[vbgamer45]

For level 4 you can either make your own form or use inline javascript.
Level 5 you can use inline javascript. If you make your own form you have to make sure that the request to the server that the reffer is the previous page on hackthissite.org otherwise it will be invaild.

[tr333]

how would i go about spoofing the referrer with javascript?