Please ask questions ONLY in this topic.

A little girl made a website to post poetry related to peace and understanding. American fascists have hacked this website replacing it with Hitler-esque propaganda. Can you repair the website?

Re: Please ask questions ONLY in this topic.

Post by aryannale on Thu Jun 15, 2017 7:39 am
([msg=93775]see Re: Please ask questions ONLY in this topic.[/msg])

Hi.. I know Directory traversal. and i have tried it but i am getting "That isn't allowed weirdo" message.. seriously I am tired of it.. can i PM someone??
aryannale
New User
New User
 
Posts: 1
Joined: Thu Jun 15, 2017 7:29 am
Blog: View Blog (0)


Re: Please ask questions ONLY in this topic.

Post by conscience on Fri Jun 16, 2017 11:18 am
([msg=93783]see Re: Please ask questions ONLY in this topic.[/msg])

aryannale wrote:Hi.. I know Directory traversal. and i have tried it but i am getting "That isn't allowed weirdo" message.. seriously I am tired of it.. can i PM someone??


You're on the right track, but you'll need to try something/somewhere else. Feel free to throw your questions at me.
Let him who has understanding recount the number of the beast, for it is a human number: His number is 0x029A.
conscience
Poster
Poster
 
Posts: 270
Joined: Thu Jan 08, 2009 9:05 pm
Location: 127.0.0.1
Blog: View Blog (0)


Re: Please ask questions ONLY in this topic.

Post by BasicPanda on Wed Jun 28, 2017 7:01 pm
([msg=93871]see Re: Please ask questions ONLY in this topic.[/msg])

Why are some comments saying that this needed *nix commands? I started trying it and had no results and just thought logically a bit before I got it to work.
<Spoiler>
Links like this /missions/realistic/3/poems/Hacker helped tons more by allowing me to visualize the order.
</Spoiler>
BasicPanda
New User
New User
 
Posts: 9
Joined: Fri Jun 16, 2017 5:13 pm
Blog: View Blog (0)


Re: Please ask questions ONLY in this topic.

Post by AwesomeFox on Mon Jul 03, 2017 12:30 pm
([msg=93892]see Re: Please ask questions ONLY in this topic.[/msg])

Hello guys, I've completed this mission, but it really was a pain in the ***. For everybody who is still looking for the answer I have one tip, (provided you know about the dot dot slash). You need to find a way to change the source code of index.html with the tools on submit poem. You don't need to read any poems or use any *nix commands.

I also have one additional question, I've read it yesterday in this thread somewhere but I can't find it anymore,
in a real life situation the file is probably saved with a default extension (ex .txt). Is there a way to prevent this??
I've read about a what's called a nullify attack or something where you put a code before .txt but I'm not sure though.
Any info would be really appreciated.
Ty
AwesomeFox
New User
New User
 
Posts: 1
Joined: Mon Jul 03, 2017 12:08 pm
Blog: View Blog (0)


Re: Please ask questions ONLY in this topic.

Post by conscience on Tue Jul 04, 2017 1:52 pm
([msg=93897]see Re: Please ask questions ONLY in this topic.[/msg])

@AwesomeFox, @BasicPanda Uhm, I believe your comments are giving away way too much, guys. :?
Let him who has understanding recount the number of the beast, for it is a human number: His number is 0x029A.
conscience
Poster
Poster
 
Posts: 270
Joined: Thu Jan 08, 2009 9:05 pm
Location: 127.0.0.1
Blog: View Blog (0)


Re: Please ask questions ONLY in this topic.

Post by Zajt on Wed Jul 12, 2017 2:01 am
([msg=93927]see Re: Please ask questions ONLY in this topic.[/msg])

I have finished it but would need a explanation and answer to some questions. Will be spoiled if I ask them here. Can I PM anyone here?
Zajt
New User
New User
 
Posts: 3
Joined: Wed Jul 12, 2017 1:59 am
Blog: View Blog (0)


Re: Please ask questions ONLY in this topic.

Post by conscience on Wed Jul 12, 2017 11:42 am
([msg=93933]see Re: Please ask questions ONLY in this topic.[/msg])

Zajt wrote:I have finished it but would need a explanation and answer to some questions. Will be spoiled if I ask them here. Can I PM anyone here?

As always, I'm here ;)
Let him who has understanding recount the number of the beast, for it is a human number: His number is 0x029A.
conscience
Poster
Poster
 
Posts: 270
Joined: Thu Jan 08, 2009 9:05 pm
Location: 127.0.0.1
Blog: View Blog (0)


Re: Please ask questions ONLY in this topic.

Post by Kitt614 on Mon Jul 17, 2017 8:32 am
([msg=93949]see Re: Please ask questions ONLY in this topic.[/msg])

So I started this mission yesterday afternoon, slept on it, and attempted again in the morning. I knew basically what I needed to do, but I was still stumped on exactly how. So I dug around a little bit in the forum and formed an idea. So I tried it, and *voila* it was the correct way to solve the mission.

But, I wanted to know *WHY* that worked. I don't want to go in depth with exactly what I was wondering, so is there any resource that explains the missions and the theory behind why the hack is the one that works. I'm the type of person who really needs to know the "why" to fully grasp and apply solutions to future issues.

I assume a PM would be better to discuss the why and not provide a resource that gives away the answer :D . But if anyone can help, I would be much appreciated.
Kitt614
New User
New User
 
Posts: 1
Joined: Mon Jul 17, 2017 8:16 am
Blog: View Blog (0)


Re: Please ask questions ONLY in this topic.

Post by wetwilly64_64 on Thu Jul 20, 2017 12:23 am
([msg=93962]see Re: Please ask questions ONLY in this topic.[/msg])

Need some extra guidance here.

So far, i've stumbled upon the "you must enter a file" page, but not the "weirdo" page other people have mentioned throughout the thread.

I also read that you don't need SSI for this mission, but also don't need to change the URL.

So is it something that i'm missing relating to how PHP works?

I was wondering if i may PM someone to bounce a couple ideas off of since i think it might be a spoiler here
wetwilly64_64
New User
New User
 
Posts: 2
Joined: Tue Jul 18, 2017 11:29 pm
Blog: View Blog (0)


Re: Please ask questions ONLY in this topic.

Post by conscience on Thu Jul 20, 2017 2:19 pm
([msg=93966]see Re: Please ask questions ONLY in this topic.[/msg])

wetwilly64_64 wrote:..., but also don't need to change the URL.

It depends. If you're trying to solve it entering whatever guess based on forum posts, or off the top of your head, hoping something will finally work, then it's true. In that case, however, there's not much of a takeaway. On the other hand, if you approach the mission properly, you'll definitely need to fiddle with some URL as that's integral to an adequate understanding of how the site works and thus of what exactly you need to do. Can't really tell more about this without spoilers though...

wetwilly64_64 wrote:So is it something that i'm missing relating to how PHP works?

How could I judge this? We have no clue what you are and what you aren't aware of.
I understand it's likely not reasonable to post your progress and thinking here, but there's no way we can answer this question based on virtually nothing.
I suspect it's more like you're missing something regarding how the application you're attacking works.

Here's my two cents, I hope it won't give away too much (I'll flag my own post for the oldies :P to review so they can edit if needed):

- Explore!!! ... !!!!!!! ... !!! Explore even more!
- It doesn't take a genius to notice the poems feature
- What options do we have for data persistence? (If you don't know look them up!)
- Where and in what form may the data be stored (within that context of persistence)?
- Can you confirm your assumptions? (e.g. if you can access the data in a way not intended by the developer, you guessed right)
- Based on what you learned from this, can you come up with ways to use this reading and/or writing to your advantage?
- Which of these can help you advance and how?
- The rest should be fairly easy

wetwilly64_64 wrote:I was wondering if i may PM someone to bounce a couple ideas off of since i think it might be a spoiler here

Erm... I've offered that opportunity to complete strangers just 3 and 8 posts ago, so I guess it's safe to say I wouldn't tell you to f*** off if you pinged me ;)
Let him who has understanding recount the number of the beast, for it is a human number: His number is 0x029A.
conscience
Poster
Poster
 
Posts: 270
Joined: Thu Jan 08, 2009 9:05 pm
Location: 127.0.0.1
Blog: View Blog (0)


Previous

Return to (Real 3) Peace Poetry: HACKED

Who is online

Users browsing this forum: No registered users and 0 guests