i found basic 5 quite hard aswell. Well basically, remember basic four, you changed the \'to\' value to another email, in this case, it won\'t let you. I won\'t go into details now, but basically, you have to change \'to\' value on the webopage itself. To do this you have to use javascript injections. There are two main ones, \'alert\' and \'void\'. Try this out by typing in to the browser (where you enter the website adress): \'javascript:alert(\"hello!\")\'. The syntax for void is:
\'Javascript:void(document.forms[x].[name of field].value=\"anything\")\'. In our case, x is the form on the page, so if there are 4 forms ont the page, x would be 3. Obviosly name of the field is literally, the name of the field, so it is \'to\'
This site is the collective work of the
HackThisSite staff. Please don't reproduce in part or whole without permission.
Page Generated: Fri, 09 Jan 2009 18:06:42 -0500 Exec:
33 Page loaded in 0.17285 seconds!
just type the sql injection into the url bar, e.g. copy this:
javascript:alert(\"hello\")