M0N73 CRIS70

  Uncle Arnold's Local Band Review  Your friend is being cheated out of hundreds of dollars. Help him make things even again! After Finishing our basic missions and JavaScript missions we gained a lot of confidence.Now it is time to test in real life scenario. This is where Realistic missions comes in handy. ================================================== It Says: From : HeavyMetalRyan  Message: Hey man, I need a big favour from you. Remember that website I showed you once before? Uncle Arnold's Band Review Page ? Well, a long time ago I made a $500 bet with a friend that my band would be at the top of the list by the end of the year. Well, as you already know, two of my band members have died in a horrendous car accident... but this ass hole still insists that the bet is on! I know you're good with computers and stuff, so I was wondering, is there any way for you to hack this website and make my band on the top of the list? My band is Raging ...

There is No hint Given to us!All we have is the name  JS Obfuscation. FTW! What this means ? Obfuscation-  the action of making something obscure, unclear, or unintelligible. So clearly,it has some thing to deal with the JavaScript code.Lets find out. As usual, I typed in something in the input box and hit "check password" Got an alert "WRONG! Try again!" Now , as usual we have to go for this in the source code. Right click and select view page source (for chrome).In that search for  "WRONG! Try again!" Wow! no code found! what will we do?don't worry! go back to our page and right click on check password and select inspect.Got the code below: <button onclick="javascript:if (document.getElementById(&quot;pass&quot;).value==&quot;j00w1n&quot;){alert(&quot;You WIN!&quot;);window.location += &quot;?lvl_password=&quot;+document.getElementById(&quot;pass&quot;).value}else {alert(...

Fiftysixer decided to try his hand at javascript!All was going well until he realized that he forgot to remove the unused code, which resulted in a confusing mess.He didn't mind, in fact, he did his best to make it even MORE confusing! As usual I Tried by giving random input and hitting check password error message alert : Nope, try again so I got a hint..like in other mission we can look in the source-code for "Nope, try again". Right click the page and select view source. ctrl+f  find tab opens ,paste "Nope, try again" hit enter. <script language="javascript"> RawrRawr = "moo"; function check(x) { "+RawrRawr+" == "hack_this_site" if (x == ""+RawrRawr+"") { alert("Rawr! win!"); window.location = "about:blank"; } else { alert("Rawr, nope, try again!"); } } function checkpassw(moo) { RawrRawr = moo; checkpass(RawrRawr); } </script> ...

Uhm, faith spelled runescape wrong? Just like other missions we have a password field.I tried to type random letters and hit enter and I got the error message "Nope... try again!"  What should we do?Just like every other mission, view source and find the javascript behind this.When i looked inspect at the submit button, i got the name of javascript function, check.In the source code, find check finding it with  ctrl+f . <script language="Javascript"> moo = unescape('%69%6C%6F%76%65%6D%6F%6F');       function check (x) {         if (x == moo)         {           alert("Ahh.. so that's what she means");           window.location = "../../../missions/javascript/5/?lvl_password="+x;         }         else {           alert("Nope... try again!");         } } </s...

Faith is trying to trick you... she knows that you're tired after all the math works...   So, we are facing another java-script challenge.whatever the challenge, we should check all our previous knowledge here.Type in something and hit  Check Password .It alerts "Rawr, nope, try again!". Lets view the source code.Right click and select view source.Now right click on the check password button and inspect,we saw the following code, <button onclick="javascript:check(document.getElementById('pass').value)">Check Password</button> Now we know that whatever we type is send to check function.Go to the  source code we already viewed a nd search for check. GOT THIS SCRIPT: <script language="Javascript"> RawrRawr = "moo"; function check(x) {         "+RawrRawr+" == ...

They are giving us a code of java script and we need to find the password from this code!its pretty simple code: ===== var foo = 5 + 6 * 7 var bar = foo % 8 var moo = bar * 2 var rar = moo / 3 function check(x) {         if (x.length == moo)         {                         alert("win!");                         window.location += "?lvl_password="+x;         } else {                         alert("fail D:"); } } ======== from statement   function check(x) , we know that our input is taken into the variable(storage space) 'x'.That means,      >>  if (x.length == moo)  <<  This condition checks if our input password length is equal to the value of moo.If condition is corre...

When we look at the hint, its nothing useful there!at least we don't find anything at a single glance.So, lets do our regular steps,view source and read scripts after clicking, Take this challenge! I found nothing! wait a moment!! usually when we try to run online games or graphical application ,most of time our browser asks us to enable java-script or enable flash! do you realize?if that is the case we are wasting our time by thinking hardly about the possible solution while all you have to do is to disable your javascript in browser in chrome click that button 'Secure' and from drop down look for java-script and disable it..Then reload the webpage(Make sure url is this :https://www.hackthissite.org/missions/javascript/2/    or just goto this link) and yes! we have completed this level.. So what this level teach is that you don't have to always think too much in hacking mind ...make time to think even as a basic user.We should think in every ways possi...

Idiot Test faith is learning Javascript, the only thing that is protecting her from hackers is luck.  REQUIREMENT ============= Before we go into the javascript mission , you should know the basics of javascript..atleast you should be able to understand the code written in JavaScript! YOU CAN LEARN BASICS OF JAVASCRIPT FROM:  w3schools   or  SoloLearn ON OUR MISSION =========== This mission has a password field in it and a submit button "check password". But,as always we do not have the password.As usual we type in something and click the button to check its response. It says "Fail D:" now, even i tried with empty password and it still says same message. But, there is something different here than in basic levels,the message is shown in alert box, which means java-script is clearing in action behind this.Lets view its source code.Right click and select view page source.Now, here you have two option for finding the script in use, first is press "...

Sam decided to make a music site. Unfortunately he does not understand Apache. This mission is a bit harder than the other basics. As you may have noticed! when we visit this level all we are given with is some line about song.This line changes on each refresh.From this we assume that this is not the real page we need to visit.But how we find our requirement? There is a tool in Kali Linux called 'Dirb'. But for now Iam using an online service for this >> URL FUZZER << . First we give the url and search for files with .php extension. select start scan.Wait for scan to finish. So,we have found a file.Now visit it as: https://www.hackthissite.org/missions/basic/11/index.php There is our login page.still we are stuck!we don't have the password or any hint in the source code of this page. Lets run another scan on the URL Fuzzer ,this time for directories  Same way start scan and wait for it to finish. There are two possible directori...

Please enter a password to gain access to level 10 Only this much is written as hint.What we should do? I have tried reading the source code and there is no hint how the password is validated.So,we have no other way than intercepting the data.Once we enter the password and hit submit the password along with some request is sent to the server by the browser.There can be very vital information in this request.What we do is intercept this request before it is sent to the server.For this we use "Burp Suit" or some extensions for tampering data.For chrome and firefox,we have tamper data addon.Iam using chrome add on:  Tamper Chrome HOW TO USE IT? *Right click somewhere and select inspect. *Now select the three arrows pointing right on top right corner. *Now select  Tamper from it(make sure you have added the extension in             chrome). *Now input some password in out mission or leave it empty and hit submit. ...

Sam remains confident that an obscured password file is still the best idea, but he screwed up with the calendar program. Sam has saved the unencrypted password file in /var/www/hackthissite.org/html/missions/basic/8/  However, Sam's young daughter Stephanie has just learned to program in PHP. She's talented for her age, but she knows nothing about security. She recently learned about saving files, and she wrote a script to demonstrate her ability. So, we know the password is stored in some obscured password file.  Lets try the same code as we did in level 7. But the code 'ls' is not treated as command. so lets try it differently. Try with aaa;<!--ls--> it also failed but got a message: If you are trying to use server side includes to solve the challenge, you are on the right track: but I have limited the commands allowed to ones relevant towards finding the password file for security reasons(because there will always be that one person who decides to ...

Lets start our journey with hack this site.Visit the website and make an account.Login with your account. Now we are going to look at basic 1. Select Basic missions from left tab and choose basic 1 "This level is what we call "The Idiot Test", if you can't complete it, don't give up on learning all you can, but, don't go begging to someone else for the answer, thats one way to get you hated/made fun of. Enter the password and you can continue. " This is the easiest level.It teaches you this, you should first look into the source code for some clue or vulnerability. Yes! Just right click on the page and select view-source.Now you can see the source code.Read along the lines until you find the line containing password:   SPOILER HERE Yes you have hacked the first level!