Your Ad Here

We have moved to

ATX If you are this blogs reader, I encourage you to visit and join ATX. This blog will not be discontinued but all the recent updates will be on ATX. ATX brings you a more exciting look, more premium software for free and ofcourse a chance to win invitations of some selected sites.


Resource site of Computer software, Phone application, E-books, Programming codes, yahoo tools, tutorials, hacking tools, keylogger, trojan, hacking, MP3 and much more. ::CORE™::

Saturday, August 29, 2009


Your objective today is to crack this application. However, please try to avoid causing real damage to the site, as many people need to use it
First steps
There are several users set up for this application with user names from aa to zz (with passwords the same as user names). There is a further user whose identity you may discover in the course of your investigations. You should use a user name that relates to your workstation ID, so if your workstation is CS206a, your user name will be aa
Try the application. See what it is supposed to do. Are there any exploits which immediately spring to mind? See what happens if you enter
instead of an email address into the optional email input box
In itself the result of doing this is mildly irritating but not especially harmful. What might a malicious user be able to do to make it more dangerous? e.g. hints 
  • JavaSpt can be used to load a new page to replace the existing one
  • Bad HTML (especially in tables) can wreck a page
You may spot one or two other flaws- a good trick is to try to enter unlikely data into form fields. My personal favourite characters are the following
? ' > < % \ | #
Note that in this application only a couple of these will cause surprising effects
Most of the application's flaws will only become obvious with a bit more probing
Looking at the HTML
Now save the form to a local directory (save it with a .html extension, then it will be easier to use
Look at the source code. Try to work out how to give yourself a very good mark in the test
Some starting points
Your first task will probably be to modify the action of the form to point to the absolute URL of the receiving pageTry to work out how the application allocates marks. If you think that the method used seems silly, I have seen real applications which allocated real test scores for real students which do this
Are there any hidden fields that you might modify
It would be a bit easier to hack if you could see the information sent from the form to the receiving page. Modify the form to use GET instead of POST. This will then allow you to play with the data sent to the page directly, rather than via the form.
More advanced
It would be a lot easier to hack if you had access to the database file. It may be possible to find out what this is called if you send some data that will cause an error. Try to work out how to do this. If you find the name of the database, download it
Content provided by SharpSoft


Post a Comment | Feed

Post a Comment

Related Posts with Thumbnails


Widget by Blog Godown


Center of Reverse Engineering™ Copyright © 2009 Premium Blogger Dashboard Designed by SAER

ss_blog_claim=982832c1e8ace00c1392e8b9a7a4bbfd ss_blog_claim=982832c1e8ace00c1392e8b9a7a4bbfd