Extended basic 6

[goluhaque]

I know about d register_globals. i also know wat 2 do with d URL(only 2 things affect the response, a variable and a function value, the variable's value depending upon the function's in the code given). wat i don't know is dat to make d value TRUE, can v simply put 1 or v hv 2 entr TRUE. Also what eludes me is dat is TRUE here a string(i.e. o v hv 2 use inverted commas).

<edit>never mind,did it </edit>

[faazshift]

@greggunner: For this mission it doesn't really matter the value, as long as you get the right variable.

[kaoS555]

Took me a bit to figure out how to properly pass the variable through as it didn't work by itself $:) but then I re-read the page and figured things out

[cissou]

I think I get the mechanics, but it just won't work.
A certain variable is uninitialized. I want to set it to a certain value so that I am granted access to the site. I can do this easily with a GET injection because register_globals is set to TRUE (this I am assuming by reading the comments of people who succeeded).

Problem is : that is not working. What am I doing wrong ?


EDIT : ridiculous... Don't forget to add the "http://moo.com" when submitting your solution

[sasha95]

Excuse me, perhaps what I'm about to say is not right. If so, please correct me as soon as possible. There's been a lot of confusion with this mission, I've been confused myself. The thing is, nowadys everyone knows that you can't modify a get variable if it isn't requested (as user and pass). You should add to the mission's description something like : This site in run by a new sysadmin who you might say is a bit 'outadated'.

That way, you will be able to find the answer using more the logic than luck, perhaps... unless that's what you want, that's why I'm asking you please to revise my post. Thank you

[sanddbox]

Excuse me, perhaps what I'm about to say is not right. If so, please correct me as soon as possible. There's been a lot of confusion with this mission, I've been confused myself. The thing is, nowadys everyone knows that you can't modify a get variable if it isn't requested (as user and pass). You should add to the mission's description something like : This site in run by a new sysadmin who you might say is a bit 'outadated'.

Uh, what?

[fashizzlepop]

You're supposed to look through the code to figure out what makes it vulnerable. Logic isn't your first angle of attack.

Most of the challenges involve exploits that would easily have been avoided if the site designer wasn't a nit-wit.

[drnkr]

Here's a tip. Variables you pass in an URL don't necessarily have to begin with a dollar sign.

[idetker]

This level's solution checking is way too permissive and it allows many "wrong" solutions as it only checks for stuff like "http://", ".php" and you know what else

[ChronosX]

Excuse me, perhaps what I'm about to say is not right. If so, please correct me as soon as possible. There's been a lot of confusion with this mission, I've been confused myself. The thing is, nowadys everyone knows that you can't modify a get variable if it isn't requested (as user and pass). You should add to the mission's description something like : This site in run by a new sysadmin who you might say is a bit 'outadated'.

Uh, what?

Think he is saying that as this feature: "This feature has been DEPRECATED as of PHP 5.3.0 and REMOVED as of PHP 5.4.0." there should be some hint that the PHP version the mission is using is outdated which I agree with.