Participate in experiment on Intrusion Detection

[haakjes]

Hi,


We created a system, which detects attacks on a website and creates a
list of the attackers and their skill level. Now, we have set up an
experiment to test this system and could use the help of hackers,
security professionals, crackers, script kiddies and all others with at
least some ability to compromise a website.

In this experiment, we ask you to compromise a website (which contains a
number of security problems). Then, we ask you some questions to
determine your skill level and compare this to the output of our system.

To participate in this experiment, please go to:

http://130.89.241.108


Thank you in advance,

Frank

[Goatboy]

As far as I can tell, this is legit. It asks for an email though, and I'm too lazy right now to start.

[haakjes]

Any help is much appreciated, even if you can only try for a couple of minutes. For the e-mail: I can image people do not want to give their e-mailaddress in some hacker experiment. An option would be to use Mailexpire and set up a temporary forward (set lifespan to one week).



Best,

Frank

[sanddbox]

So far this is a fun challenge. Nonpersistent XSS vulns, directory traversal...

[Bren2010]

^ Yeah, it is. It has a lot of tings I wouldn't really think about trying on most of the missions here.

[IncandescentLight]

Found the XSS, MySQL and directory transversal vulnerabilities. However, the directory transversal vulnerability lead to a shadowed password, to which access is blocked. If anyone could tell me, how would I get this file? Tried cookies, but did not work.

[sanddbox]

Found the XSS, MySQL and directory transversal vulnerabilities. However, the directory transversal vulnerability lead to a shadowed password, to which access is blocked. If anyone could tell me, how would I get this file? Tried cookies, but did not work.

You can't get the password file itself, but you can get the etc/passwd file and pretty much any other file.

[IncandescentLight]

Aww... Oh well, was a fun test. See how the skills learnt here worked out in a 'real' website.