Please ask questions ONLY in this topic.

[Slahd]

I finally did it! It seems so much simpler than it did back when I first saw this mission. Here's an extremely vague thing I did to it. 500.
Overkill, much?

K

[ereK]

getting madddddddddddddddddd

i tried maybe everything but not a good way for this one lol

[Slahd]

Well, remember that it's not about getting the band to the top of the page. It's about making #1. What one thing on that webpage will make Raging Inferno #1? Or rather, what one thing made Imposing Republic #1? Try to make some changes to it and look at the number I posted on my post above yours.

S

[ereK]

Sladh

can i pm you my approach ???

[Slahd]

You may. I'll try not to tell you the exact solution, but with PM's, I can elaborate more than on the forums.

S

[winter-owned]

I just wanted to say that the solution to this mission really is useful and realistic. I've been doing missions on HTS for a while. I've done half of the basic missions and most of the javascript missions without really getting a sense that I was learning anything that I could apply to non-HTS hacking.

I've found several websites that are vulnerable in the way the band review page is. Pretty exciting. Now if only I had a friend who was going to lose an unfair bet ...

[conscience]

[OFF]Mixing this one up with some deeper ones you'll encounter during HTS realistic missions, you'll discover much more serious flaws in the web apps out there Unfortunately this is very often and usually compromises sensitive data. The best part of the story is that if you alert the stuff of the site that you have found a serious security hole that must be fixed ASAP, they usually don't give a crap, leaving data of the users (e.g. personal data like mailing address or phone number) exposed to anyone. [/OFF]

[EDIT]ereK: If you're still having difficulties with this one, you can PM me.[/EDIT]

[talexyy]

Well, I did it and it was quite easy. But one question remains, will this technique work in any situation on any site?

[Phantom Wolf]

Well, I did it and it was quite easy. But one question remains, will this technique work in any situation on any site?

No. I doubt you'll find any serious site vulnerable to this.

[conscience]

Well, I did it and it was quite easy. But one question remains, will this technique work in any situation on any site?

No. I doubt you'll find any serious site vulnerable to this.

Some mid-sized and small sites actually tend to share this flaw even with an underlying SQLi