|
|
 |
|
|
Thread Tools | Display Modes |
Sep 29th, 2005, 4:39 PM
|
#11 |
|
Hobbyist Programmer
Join Date: Dec 2004
Location: CA
Posts: 102
Rep Power: 4
  |
It is look like you get this code of this site
That site contains Reverse Engineering stuff and the Javascript protections... sounds interesting... maybe you should ask the cracker Fravia...hehehe.. I guess you want to be a Cracker (Black Hacker) .. oh welll good luck studying those scripts...
__________________
-- pr0gm3r |
|
|
Sep 29th, 2005, 5:32 PM
|
#12 |
|
Programming Guru
 
Join Date: Oct 2004
Posts: 1,041
Rep Power: 5
   |
I went to the page, cracked it in about 5 secs.. w00t, go me.
Type these three things in your browser URL bar in order: [php] javascript:void(nls=0); javascript:void(chPwd()); javascript:void(alert(nls)); [/php] Step 1) Make nls global. Step 2) Run chPwd to fill user/pass test string. Step 3) Tell us what the user/pass test string was, giving us the username and pass... The results are returned in "username*password*" format. Enjoy.
__________________
|
|
|
|
Sep 29th, 2005, 6:36 PM
|
#13 |
|
Programmer
Join Date: Jul 2005
Posts: 62
Rep Power: 4
|
It was a challenge from mod-x. A rather simple one too. The thing is, is that you should be the one to figure this out, you shouldn't be having others do it for you, which is the piont of the site.
|
|
|
|
Sep 29th, 2005, 6:48 PM
|
#14 | |
|
Resident Grouch
Join Date: Jun 2005
Posts: 6,453
Rep Power: 10
|
Quote:
__________________
Abstraction doesn't make it impossible to write bad code; it makes it possible to write superior code. Contributor's Corner: Grumpy on C++ Exceptions DaWei on Pointers |
|
|
|
|
Sep 29th, 2005, 6:53 PM
|
#15 |
|
Programming Guru
Join Date: Oct 2004
Posts: 1,041
Rep Power: 5
|
The kind of techniques i showed are only usable on this one script on this one site, which will (for the fact it's on a site on the premis it's insecure) never be used for any actual security purpose...
__________________
|
|
|
|
Sep 30th, 2005, 8:13 AM
|
#16 |
|
Programmer
Join Date: Sep 2005
Posts: 50
Rep Power: 0
|
i am not hacking or trying to get a invalid access to a machine or trying to get ./root . and if u ppl think i am breaking the rules them tell me how too delet this post or close it.
i am just putting forward a question. this problem was put by mod-x (easy javascript challange)that i gotta find a valid username and password. this code has a big bug, a loop hole, that makes it a poor protection method. i have re-posted the code. <html>
<head>
<title>www.disavowed.net</title>
</head>
<body bgcolor="#333333" text="#00FF00" link="#00FF00" vlink="#00FF00" alink="#00FF00">
<SCRIPT LANGUAGE="JavaScript">
<!--
al="`1234567890-=~!@#$%^&*()_+qwer"
+"tyuiop[]QWERTYUIOP{}|asdfghjkl;A"
+"SDFGHJKL:zxcvbnm,./ZXCVBNM<>?";
ab1="";
bctr=0;
function ckPwd(){
tst=document.isn.username.value
+"*"+document.isn.passwrd.value+"*";
ls=document.pd.pe.value;
a=eval(ls.substring(0,2))-91;
ls=ls.substring(2,ls.length);
nls="";
flg=0;
while (ls.length>12){
ab=eval(ls.substring(0,2))-89;
ab1=(ab1==""?""+ab:ab1);
oab1=ab1;
ls=ls.substring(2,ls.length);
for (var i=0;i<ab;i++){
nr=eval(ls.substring(0,2))-a;
ls=ls.substring(2,ls.length);
nls+=al.charAt(nr);
}
nls+="*";
if (nls.indexOf(tst)>-1){
ls="";
flg=1;
}
}
if (flg==1){
tstOk();
}
else{
bctr++;
if (bctr>3){
location.href="wrongpage.php";
}
else{
alert("Sorry. Bad Username or Password."
+" Failed Attempt #"+bctr+".");
}
}
}
function tstOk(){
ab1=ab1+""+a;
alert("OK. You Entered a Valid Username and Password, "
+document.isn.username.value+"! Taking you to the"
+" restricted page as soon as you click OK.");
location.href="pwdss.php?"+ab1;
}
function srand() {
today=new Date();
rand=today.getTime();
picker=""+rand
picker=picker.charAt((picker.length-4));
rec=eval(picker);
}
// -->
</SCRIPT>
<FORM NAME="pd">
<INPUT TYPE='hidden' NAME='pe' VALUE='9999621534361185176113439965168437841040414209'>
</FORM>
<table border="0" cellpadding="0" cellspacing="0" width="100%" height="100%" bgcolor="#000000">
<tr>
<td width="100%" valign="middle" height="100%">
<div align="center">
<center>
<table border="0" cellpadding="0" cellspacing="0" width="95%">
<tr>
<td width="1"><img border="0" src="../../../images/phone.gif" width="164" height="257"></td>
<td width="40"></td>
<td><FORM NAME="isn">
<div align="center">
<center>
<table border="0" cellpadding="0" cellspacing="0">
<tr>
<td><font face="Courier New" size="2">Login name:</font></td>
<td width="10"> </td>
<td><INPUT TYPE="text" NAME="username" VALUE="" SIZE=20 STYLE="font-family: Courier New; font-size: 10pt"></td>
</tr>
<tr>
<td height="10"> </td>
<td height="10"> </td>
<td height="10"> </td>
</tr>
<tr>
<td><font face="Courier New" size="2">Password:</font></td>
<td width="10"> </td>
<td><INPUT TYPE="text" NAME="passwrd" VALUE="" SIZE=20 STYLE="font-family: Courier New; font-size: 10pt"></td>
</tr>
<tr>
<td colspan="3" height="10">
</td>
</tr>
<tr>
<td width="150%" colspan="3">
<p align="center"><INPUT TYPE="button" NAME="submit" VALUE=" Submit " STYLE="font-family: Courier New; font-size: 10pt; font-weight: bold" onClick="ckPwd()"></td>
</tr>
</table>
</center>
</div>
</FORM>
</td>
</tr>
</table>
</center>
</div>
</td>
</tr>
</table>
<SCRIPT LANGUAGE="JavaScript">
<!--
document.isn.username.focus();
// -->
</SCRIPT>
</body>
</html>ps the challenges are in mod-x.co.uk |
|
|
|
Sep 30th, 2005, 8:55 AM
|
#17 | |
|
Programming Guru
Join Date: May 2004
Location: Brandon, Manitoba, Canada
Posts: 2,023
Rep Power: 7
|
Quote:
Tempest cracked it already for you. Please read other people's post before posting! I feel that this thread is a exception to the hacking rule as the code will (well i hope so anyways) never be used on a real site. However if it is a challange why did you come here to get one of us to do it for you? Why not learn how to do it your self. This thread is no better than when students come on here and ask us to do their homework.
__________________
Profanity is the one language that all programmers understand. Check out my Blog <---updated Nov 30 2007! |
|
|
|
|
Sep 30th, 2005, 9:44 AM
|
#18 | |
|
Programmer
Join Date: Sep 2005
Posts: 50
Rep Power: 0
|
ok i agree i had done the worng way.
now as u said Pizentios Quote:
thanks all |
|
|
|
|
Sep 30th, 2005, 2:00 PM
|
#19 | |
|
Programming Guru
Join Date: Oct 2004
Posts: 1,041
Rep Power: 5
|
Quote:
__________________
|
|
|
|
|
Sep 30th, 2005, 2:56 PM
|
#20 | |
|
Programming Guru
Join Date: May 2004
Location: Brandon, Manitoba, Canada
Posts: 2,023
Rep Power: 7
|
Quote:
i know, but it still shouldn't be done.
__________________
Profanity is the one language that all programmers understand. Check out my Blog <---updated Nov 30 2007! |
|
|
|
|
| Bookmarks |
| Currently Active Users Viewing This Thread: 1 (0 members and 1 guests) | |
| Thread Tools | |
| Display Modes | |
|
|
Linear Mode
