L!nK Intro: Hack This Site is a free, safe and legal training ground for hackers to test and expand their hacking skills. More than just another hacker wargames site, we are a living, breathing community with many active projects in development, with a vast selection of hacking articles and a huge forum where users can discuss hacking, network security, and just about everything. Tune in to the hacker underground and get involved with the project. Lets just call it a..Hacker Playground Basic 1 - The Idiot Test Inspect the page source and in a comment you will find the password. Basic 2 "Network Security Sam set up a password protection script. He made it load the real password from an unencrypted text file and compare it to the password the user enters. However, he neglected to upload the password file..." Underline the last phrase. The password is NULL. Basic 3 "This time Network Security Sam remembered to upload the password file, but there were deeper problems than that." View page source and.. <form action="/missions/basic/3/index.php" method="post"> <input type="hidden" name="file" value="password.php" /> <input type="password" name="password" /><br /><br /> <input type="submit" value="submit" /></form> Underline the second line of the code(value="password.php"). Add 'password.php' to your URL bar and go. Basic 4 - Javascript FTW "This time Sam hardcoded the password into the script. However, the password is long and complex, and Sam is often forgetful. So he wrote a script that would email his password to him automatically in case he forgot. Here is the script:" View page source and: <form action="/missions/basic/4/level4.php" method="post"> <input type="hidden" name="to" value="webmaster@hulla-balloo.com" /> <input type="submit" value="Send password to Sam" /></form> </center><br /><br /><center><b>Password:</b><br /> <form action="/missions/basic/4/index.php" method="post"> <input type="password" name="password" /><br /><br /> <input type="submit" value="submit" /></form> What now? Javascript injection. Clear the URL bar and enter this: javascript:void(document.forms[0].to.value="email@NANO_SUX.whatever") Due to the fact that this is the first form in the page, its number (forms[number]) is 0. The name of the form is 'to', so after forms[number] it comes its name. In order to see the changes after that command enter javascript:alert(document.forms[0].to.value) So, after all, the URL bar will look like this: javascript:void(document.forms[0].to.value="your_email@NANO_SUX.whatever"); javascript:alert(document.forms[0].to.value) Click on 'Send password to Sam' and you will get the password. Another way of doing this is to download the whole page and edit it. This method is more time-consuming than the first. Basic 5 "Sam has gotten wise to all the people who wrote their own forms to get the password. Rather than actually learn the password, he decided to make his email program a little more secure." Inspecting the source code: <form action="/missions/basic/5/level5.php" method="post"> <input type="hidden" name="to" value="webmaster@hulla-balloo.com" /> <input type="submit" value="Send password to Sam" /></form> </center><br /><br /><center><b>Password:</b><br /> <form action="/missions/basic/5/index.php" method="post"> <input type="password" name="password" /><br /><br /> <input type="submit" value="submit" /></form> Got it? Do the same for this mission as you did for 4. ------------------------------------------------ More to come. Now I got some work to do and I gotta respect the schedule. See ya. EDIT: Scuze, m-am grabit si l-am postat unde nu trebuie. Daca poate sa fie mutat la tutoriale in engleza raman dator. Astept opinii.