Please ask questions ONLY in this topic.

[MassReset]

Still working on this one, would just like to say that maybe HTS shouldn't link the images from ANP, because seeing "support" there I thought, "Oh, they must not have the images in the same dir as the html, so that must be where the login is, " and ended up at their actual site.

[WallShadow]

Still working on this one, would just like to say that maybe HTS shouldn't link the images from ANP, because seeing "support" there I thought, "Oh, they must not have the images in the same dir as the html, so that must be where the login is, " and ended up at their actual site.

I second this.

[Elemenophee]

SQL Error -> check, a single ' can fuck you

Maybe this is too much for be considered a spoil, be fast mods in case it is. *yeah only because you directly related the video to this mission...*

[Paraknight]

Looks like update2.php is broken server-side.

[limdis]

Should be fixed now

[cp92]

I solved this, but I never got the admin password. Is there a mistake? If I'm spoiling, please remove. Thanks

[fashizzlepop]

No mistake. That's the point. Bypass the password without ever having to know it.

[Ufonautas]

Haha, that was so simple, and i was looking for a ways fo find contents of database to get username.

Hint 1: Simple

Hint 2: Logging in as a first person on sql type database

Hint 3: Bootlean


By the way, i just found out that their real site has some flaws too,
*sorry mate*

check this out, you can see their variables, as i remember it is possible to send information them using get method. So, it may be next realistic version?

Please, someone more experienced tell me if i'm on the right track for real website. I don't want to hack them, i just want to know if i THINK the right way.

Good luck to everyone who's on this (2) challenge!

[matthew1987]

Can someone explain to me why only that syntax works I kind of understand the idea behind the command but I don't understand the placement of the extra characters.

[fashizzlepop]

Then you don't understand SQL Injection and SQL statements. I'd research it some more.