Please ask questions only in this topic.

[lambda0]

A bit of handy advice: when you find a way to "list" the files of ~/realistic/14/ it would be smart to view the source directly as your browser will most likely kill the first line of files. Note the viewing it normally won't show the 2 things EVERY directory should have: "." and "..".

[eljonto]

I'm stuck at the moderator panel for so much time. Which username should I search for?

you don't know specific usernames so you know you can't enter one. Think- who would be the first user to be mad on a forum site set up by an admin? now think, since the input isn't a username, it must be a command, and what command will allows you to view the poisition in the data table where the admin username would be.

[vbCrLf]

I'm stuck at the moderator panel for so much time. Which username should I search for?

you don't know specific usernames so you know you can't enter one. Think- who would be the first user to be mad on a forum site set up by an admin? now think, since the input isn't a username, it must be a command, and what command will allows you to view the poisition in the data table where the admin username would be.

First user to be mad? I don't get you... Can't think of anyone/anything.
Regarding the command, is it some sort of SQL injection?

Thanks,
Ori.

[secdef9]

I'm stuck at the moderator panel for so much time. Which username should I search for?

you don't know specific usernames so you know you can't enter one. Think- who would be the first user to be mad on a forum site set up by an admin? now think, since the input isn't a username, it must be a command, and what command will allows you to view the poisition in the data table where the admin username would be.

First user to be mad? I don't get you... Can't think of anyone/anything.
Regarding the command, is it some sort of SQL injection?

Thanks,
Ori.

You're on the right path. Go wild

[vbCrLf]

you don't know specific usernames so you know you can't enter one. Think- who would be the first user to be mad on a forum site set up by an admin? now think, since the input isn't a username, it must be a command, and what command will allows you to view the poisition in the data table where the admin username would be.

First user to be mad? I don't get you... Can't think of anyone/anything.
Regarding the command, is it some sort of SQL injection?

Thanks,
Ori.

You're on the right path. Go wild

I read your post again and again and couldn't think of anything wilder. Until I read it loudly That was really wild.
Without your last word I would never get that. Thanks secdef9 and eljonto

[eljonto]

err yeah, that was a typo- sorry, i meant to write 'made' not 'mad' O.o

[T0ha]

Hi,
could you give me a hint where can i found name of account to view it in m*******r.c** file.
But please be more specific.

[relictus]

My problem is that I can't see the source of the m********.cgi file; the approach using null byte poisoning that I used for listing the files in the directory fails when applied to that file, while it works for other files in the same directory. Can anybody give me an hint?

[bala-linux]

My problem is that I can't see the source of the m********.cgi file; the approach using null byte poisoning that I used for listing the files in the directory fails when applied to that file, while it works for other files in the same directory. Can anybody give me an hint?

Same issue Looks like not able to view the source for any cgi. Any hint please ?

FYI : I am getting "Malformed Request".

[Defience]

It seems that there is currently an issue with that part of the mission, please submit it a bug report so that a developer may correct it. Thanks.