Please ask questions ONLY in this topic.

[Defience]

Sanddbox please read the forum in its entirety, if you have think about the directory you're accessing.

Also I can't figure out the cookie stealer part. I got to the message that says your cookie stealer appears to have worked but nothing seems to have happened. Also it says Nothing happened. Method or object not found. on the top left of the message. Finally, when I launch cookie editor it first shows me the cookie for the cookie stealer url. Am I supposed to put a hackthissite.org url in my javascript?

If your cookie stealer is in php than your script should point to the hosting site such as t35.com, so it knows where to send the cookie information to.

[bgonzales999]

If your cookie stealer is in php than your script should point to the hosting site such as t35.com, so it knows where to send the cookie information to.

Ok now I was able to get the cookie info but when I created a new cookie it didn't do anything. I did everything the same in the new cookie that was in the old PHPSESSID cookie, but I changed the name and content according to the one I stole. Did I do something wrong?

[Defience]

I'm not sure if I understand your question correctly but once you get the cookie information, you do not need to create an entirely new cookie from it, just modify your existing cookie ( while logged in to hts) to the new PHPSESSID, sorta like basic 10.

[bgonzales999]

I'm not sure if I understand your question correctly but once you get the cookie information, you do not need to create an entirely new cookie from it, just modify your existing cookie ( while logged in to hts) to the new PHPSESSID, sorta like basic 10.

In the end I did have to create a new cookie, but now I'm stuck at the SQLite. I did the directory transversal and I'm seeing the two tables from the **.db*** but now I have no clue what SQL commands to use view the contents of the tables. Can someone post a link where I can learn about the commands I need?

EDIT: I finished after three days. Yay!

[gregorian]

There is no need to use User Agent XSS. You can directly find the page you want in the log. Was this alternative an intentional shortcut?

[___BARBARIAN___]

I stuck...gimmi a kick plz...................I am trying to edit/update users pass but geting reply user not exists....and if I trying to manipulate form nothing happens..plz help me....

[andro1d]

Is this normal behavior? I'm getting this error when attempting to change what database is being executed against:

DBI connect('dbname=./db/../../../d*.d***e','',...) failed: unable to open database file(1) at dbdimp.c line 94

Why has no one else mentioned this :/

[smartmalk]

Is this normal behavior? I'm getting this error when attempting to change what database is being executed against:

DBI connect('dbname=./db/../../../d*.d***e','',...) failed: unable to open database file(1) at dbdimp.c line 94

Why has no one else mentioned this :/

It's just a matter of setting the right path, it shouldn't take too long to get that right, there's only so many options you can try.

I completed this challenge but reading through these posts makes me wonder why people would be talking about XSS and User Agents for this challenge cause I needed none.
I guess it'd be interesting to see other ways to solve this.

[Statixs]

One fantastic level. For myself it felt awesome when i completed it, had to look less on the forum only for the final part!
For the HTS crew: Awesome mission.

[tullyvey]

Firstly, a big thank you to the HTS team for this very fun challenge

I didn't want to set up my own site for stealing the cookie, so skipped this challenge. Then, in the Heartland school district site, I found one of the students had set up a guest book that served the purpose...