Please ask questions ONLY in this topic.

[silkhound]

I'm actually glad it took me a while to get this one done -- it gave me an excellent chance to learn some more about SQL!
As for my hint: I'm gonna try to be cryptic here.

I tried a buttload of variations on the 'testing' theme, but they all got me a:
SQL Error:
.

I believe this is a warning message about your syntax. If you're getting it, you're close. Just read your injection again.
Sometimes it is the end that ruins the injection.

[fashizzlepop]

Sometimes it is the end that ruins the injection.

Or lack there of...

[leperchon2304]

ok so ive read up on SQL injections but i must be imputing it wrong or something because all i get is the invalid username/password page. im supposed to insert it in the source code right?

[mShred]

ok so ive read up on SQL injections but i must be imputing it wrong or something because all i get is the invalid username/password page. im supposed to insert it in the source code right?

Try reading up on SQL a little more.. I think you've got the basic principle a little off.

[Onoref]

Read so much about sites getting hacked this way and now I finally did it myself

For people have problems with this (hopefully not to much of a spoiler):
imagine the code behind the scenes, imagine your input in that code and then think about how your input can change things ...

[fashizzlepop]

I like to bring up the "Mad Lib" analogy.

Code: Select all

The _(adjective)_ brown fox jumps over the lazy _(noun)_.

Now, just throw in what you want and you completely change the meaning AND logic.

Code: Select all

The _hairy ballsack falls off! My_ brown fox jumps over the lazy _Mexican. Give me your money_.

Notice the extra sentences now. We completely changed the logic by adding periods and more than just one word per blank.

Now, you'll want to think in terms of authentication:

Code: Select all

if $user_input_pass == "sluttyAngel2012" && $user_input_user == "MarkZuckerburg";

Just think of $user_input_pass as a blank the user fills in. Maybe make that variable a TRUE statement in itself, and, once you do that, find a way for it to ignore the rest of the statement... *couch* comment *cough*

If this and the rest of the guides listed previously can't help you with this mission, you are FAIL.

[Goatboy]

fashizzle, you get many GoatPoints for that.

[fashizzlepop]

Thank you, I'll be here all week.

This is the kinda shit we need to preface each mission. I'll be talking with Kage to see if he will allow me to add that when I port the missions to the recode.

[Goatboy]

Thank you, I'll be here all week.

This is the kinda shit we need to preface each mission. I'll be talking with Kage to see if he will allow me to add that when I port the missions to the recode.

What we need to do is take an example from Wells' spinoff of HTS (which is unfortunately down at the moment) and give a short tutorial before the mission. At the very least, explain what might be useful and maybe point to a relevant guide.

[fashizzlepop]

Yeah, that's what I meant. I also think Basic 2 is just pointless.