Basic Mission 8

[X4dd4r]

Oh god, I fianlly did it after hours I think haha
Can I PM someone to know if I did the right way ? Ty !

PM me.

[oskll]

Ok I sent you one !

[badathacking111]

Hi, I just started doing these challenges. I'm really enjoying learning all of it and I feel it has been informative. It didn't take me too long to get through 1-7, but I am stuck on this part. I got the list of the files that lead to the .shtml files. I'm not sure where to go from here. I believe I need to also change what directory I'm using? Any guidance on this would be great, Thanks!

[badathacking111]

Never mind, I figured it out. Not too difficult after all

[cessmation]

Is this mission still working? I believe I have the correct code to list the directory of VAR however I still get that same error telling me im on the right track. =/
Thanks!


---EDIT Had an extra character. =/

[D4MN4710N]

I get:
"If you are trying to use server side includes to solve the challenge, you are on the right track: but I have limited the commands allowed to ones relevant towards finding the password file for security reasons(because there will always be that one person who decides to execute some rather nasty commands). So please manipulate your code so that it is a little more pertaining to the level."

hmm... *snip-snip*

got it (it was just a *temporary* error... )

[c03l]

I finally solved this after about an hour of trying to perform multiple commands and getting the "You're on the right track" error..

If you're stuck in the same place, after seeing the shtmls you don't need, and then trying to change places, just don't make it literally any more complicated than you need to.. There's a simpler way to do it, and it legitimately made me mad when I realized because I wasted so much time trying to make it overly complicated..

[JimmyBayconn]

like idk i cant use anything besiedes just ls

[DinoII]

started to play with <> tags at start and decided to not use it anymore, because it gets converted to &lt; &gt;

somehow frustrating how i can get so wrong^^

[Croma1994]

Wow, this thing was fucked up, 2 hours to get it right. Is not difficult, the problem are the limitations and the UNIX command (is not usual in the practice to be honest). Heading to basic 9!

I learnt that pages which have incorporated SSI must block some commands that can be ejecuted from POST methods and you can gain access trough them to the PHP server and see sensitive data. The construction of the mission was nice made me go deeper inside the UNIX commands to manage filesystem dirs and read a lot of SSI stuff. Thanks.