Skip to main content

Hack This Site! Realistic 1-Uncle Arnold's Local Band Review

Related image 
Uncle Arnold's Local Band Review 
Your friend is being cheated out of hundreds of dollars. Help him make things even again!

After Finishing our basic missions and JavaScript missions we gained a lot of confidence.Now it is time to test in real life scenario. This is where Realistic missions comes in handy.
==================================================

It Says:


From: HeavyMetalRyan 

Message: Hey man, I need a big favour from you. Remember that website I showed you once before? Uncle Arnold's Band Review Page? Well, a long time ago I made a $500 bet with a friend that my band would be at the top of the list by the end of the year. Well, as you already know, two of my band members have died in a horrendous car accident... but this ass hole still insists that the bet is on!

I know you're good with computers and stuff, so I was wondering, is there any way for you to hack this website and make my band on the top of the list? My band is Raging Inferno. Thanks a lot, man!

==================================================

After reading this poor guy's message, I feel like i must help even though I am not as good in computer as he thinks and it is not easy to hack any website as he may think . So let us visit this uncle Arnold's page and see what we can do. 

I saw this guy's band name at the last of list.
Now its yours as well as my turn.Summon all the knowledge we learned in the past missions and apply it here. Analyse the webpage thoroughly,especially the button for voting.


<select name="vote">
<option value="1">1</option>
<option value="2">2</option>
<option value="3">3</option>
<option value="4">4</option>
<option value="5">5</option>
</select>
<input type="submit" value="vote!">

I don't see  any thing suspicious but we wont let anything slip away.

I just right clicked on the vote button below our raging inferno and selected inspect. The same code as above is there ..now what i did is just changed the value="1" to value="999999".

Gotcha! that's it they have no protection all we have to do was to change the value to something big and that much vote will be sent and our band will be the winner.

Comments

Popular posts from this blog

Hack This Site Basic 10

Please enter a password to gain access to level 10 Only this much is written as hint.What we should do? I have tried reading the source code and there is no hint how the password is validated.So,we have no other way than intercepting the data.Once we enter the password and hit submit the password along with some request is sent to the server by the browser.There can be very vital information in this request.What we do is intercept this request before it is sent to the server.For this we use "Burp Suit" or some extensions for tampering data.For chrome and firefox,we have tamper data addon.Iam using chrome add on:  Tamper Chrome HOW TO USE IT? *Right click somewhere and select inspect. *Now select the three arrows pointing right on top right corner. *Now select  Tamper from it(make sure you have added the extension in             chrome). *Now input some password in out mission or leave it empty and hit submit. *You will see a new tab with the request det

Hack This Site Basic 6

Network Security Sam has encrypted his password. The encryption system is publically available and can be accessed with this form: There we have been given with the same encryptor used by Sam .There is no other choice in my mind than guessing the password with the help of this encryptor. We have Sam's encrypted password already :3ff8;j<9 >Now we need to find by giving which value we get the output as 3. >when i given 'a' my output was 'a',which means no change. >So,I tried giving '3' and as expected, answer was 3. >So i pushed my luck and tried '3f',the first two letters,in encryptor ,Output was '3g'    this was clearly giving us hint.first letter has no change,second letter change by one alphabet or           letter ,clearly from 'abcdefg' >with this in mind iam giving input for encryption as '3ed',Huraaah!, it was successful and given output as '3ff'. >now its easy to break down ...

Hack This Site Basic 11

Sam decided to make a music site. Unfortunately he does not understand Apache. This mission is a bit harder than the other basics. As you may have noticed! when we visit this level all we are given with is some line about song.This line changes on each refresh.From this we assume that this is not the real page we need to visit.But how we find our requirement? There is a tool in Kali Linux called 'Dirb'. But for now Iam using an online service for this >> URL FUZZER << . First we give the url and search for files with .php extension. select start scan.Wait for scan to finish. So,we have found a file.Now visit it as: https://www.hackthissite.org/missions/basic/11/index.php There is our login page.still we are stuck!we don't have the password or any hint in the source code of this page. Lets run another scan on the URL Fuzzer ,this time for directories  Same way start scan and wait for it to finish. There are two possible directories