Please ask questions only in this topic.

[freefrag]

any eta on when its getting fixed?

[djniks143]

I HAVE APPLIED THE NULL BYTE IN N***.C** I GOT THAT LISTING OF FILES/PAGES..
I GOT M********.C** PAGE BUT I M UNABLE TO LOGIN. CAN ANY ONE TELL ME HOW TO APPLY NULL BYTE OVER THERE..

LOOKING FORWARD FOR REPLY

[relictus]

I HAVE APPLIED THE NULL BYTE IN N***.C** I GOT THAT LISTING OF FILES/PAGES..
I GOT M********.C** PAGE BUT I M UNABLE TO LOGIN. CAN ANY ONE TELL ME HOW TO APPLY NULL BYTE OVER THERE..

LOOKING FORWARD FOR REPLY

Stop using caps. Reason -> http://media1.break.com/dnet/media/2008/5/15may27-caps-lock.jpg
To view the contents of m***.c** sse the same tecnique you used to list the files.

[bgonzales999]

To view the contents of m***.c** sse the same tecnique you used to list the files.

I guess I do not understand the null byte because I cannot use it to access m********.c** source. I have made many attempts to get the page to accept my null byte but it won't. When I viewed n***.c** source I put my null byte after the s****= part. Is this wrong?

[edilVin]

I finished this mission. The only hint I wold give for the mod panel is to look for all users that may exist, about a few posts back someone mentioned sql injection, is not a bad idea but there are other options.

please remove this in case it shows too much

This is an example, now use your imagination.
http://www.hackthissite.org/user/search

[Bren2010]

Guys, just want to say, that all of you are making this harder that it needs to be.

Spoiler: Google archives sites unless instructed not to. See if the admin forgot to add an entry.

[hziggles]

OK Guys. There is absolutely NO need to use a Poison Null Byte or a PHP or Perl bruteforcer. NONE AT ALL.
This is a very vague hint: Nearly every website in existence is snuck around in and archived by robots.

-- Sun Aug 09, 2009 1:39 am --

OK I got to the admin page logged in as ******, the admin of the site, and apparently I found proof that they are doing whatever they're not supposed to be doing. But as I try to post the proof to the front page, it requires auth. Found a hash in the source code (sha1) and I am running it through John the Ripper now, but even if it does crack it in the next 100000 years, what am I supposed to do with the password? AHHHHHHHHHHHHHHH FREAKING HELP ME!!!

[Bren2010]

hziggles, are you talking about the frame that goes to hackthissite.org on the admin page? That require auth, means you have to be logged into HTS. You don't actually have to post it to the front page to complete the mission.

[bgonzales999]

I finished this mission. The only hint I wold give for the mod panel is to look for all users that may exist...

This is an example, now use your imagination.
http://www.hackthissite.org/user/search

edilVin, because of your example I'm thinking very Wildly but it doesn't seem to help. Am I on the right track?

[afrika]

Please help me "sigh"

Ok so I found the cgi query system and first tried using XSS, didn't work, so then i read up a little and found out about poison null bytes. Ok so what I need to do obviously is list the files within the parent directory.
I've tried

[Spoiler removed]

I have no idea wtf I'm doing and I can't really find a good explanation and the ones that I've seen, is exactly what I'm doing so I don't know what I'm doing =/