Please ask questions only in this topic.

[ANONRA]

Everything you need to know to complete this mission you have already done in other missions. You just have to use them to your best advantage. Read up about poison null bytes it will help in this mission. Check them out here: http://hakipedia.com/index.php/Poison_Null_Byte . Look at everything to get a grasp as to how the site is put together and you will see it is not as hard as you think. A little knowledge of perl would help but not really needed. What you need most in this mission is your eyes and a little programming know-how! Look for ways to exploit the site, where can you use the things you learned on past missions to best effect? How can you make the site show you things you wouldn't normally be able to see? Start thinking outside the box and try not to make things hard for yourself. Look for the sinple solutions. They are best here! When you complete it your will realise how easy it really was. Happy Hackin.

[deadheadd]

hahaha I too got a UN/PW combo and then sat there with it wondering where it was supposed to go for like 5 minutes

silli silli me...great mission!

on the perl for those who dont know it, almost any nix systems got it so if you have shell somewhere try that or for windows use activestate perl. if you just take the 2 subs and copy/paste them you can manually brute it...pretty easy to find a key that works....

something like:
#!/usr/bin/perl
my $key = v******("thingiwanttotry");
print "that returns: $key\n";

and paste the 2 subs you need below...

[yagmoth]

Hi, everybody!
i have a question, i now te password for the m++++++++.c++, that's i++++++ works but i don't understand why it works???? anyone can explain me???

I know the function ins't protected but i don´t really undestand why y returns t+++ when the 'pass' is type.

thanks.
EDIT: anyone can help me?

[PurpleNurple]

I've made it this far without asking for help but I'm stumped on this.
Ill try an keep it spoiler free.

I understand how the script retrieves files and what it appends to the query.
I understand how the poisoned null byte works and why it works.
I've used it to view the contents of the directory and found the important files.

My problems start when i attempt to open any other file using the poisoned null byte.
Im trying :

.../missions/realistic/14/****.c**?*****=m******%**

but i just keep getting:

failed to load m********<?>.news

<?> is a little graphic on the actual page.

I cant read any files in this manner but as far as my understanding of how the poisoned null byte works, this should be ok.
Any help appreciated!

[TheW45P]

I figured out how to read the .cgi Source-Code but it seems not to work with the login script.
Is this a bug?

[LoGiCaL__]

That one took me a while, but I finally got it. By far the best mission so far in my eyes. Thanks again HTS!!

[3vilp4wn]

Can someone confirm that in m********.c** a id of "123456" will return a value of "178799" (and thus, 0 in the script.)
I'm not sure if my script is working.