Please help......

p4p1 [lexostras]
9 years ago

0

Ok so I think I am near the solution I found this documentation http://www.exploit-db.com/papers/15446/
And I learned stuff about bypassing, I read about

-xss
-full http

And such but I really cant find the answer after some test but I still seem to fail can some one please give me a hint???

13replies
3voices
250views
dloser
9 years ago

0

Try to figure out what the code is doing with your input. Then play with that.

p4p1 [lexostras]
9 years ago

0

Ok thx @dloser

Mr. Cyph3r [MrCyph3r]
9 years ago

0

Hah, this one was a fun challenge… pretty easy when you realize how the filter works

p4p1 [lexostras]
9 years ago

0

Hy @MrCyph3r I think I understand how the filter works,

It deletes all of the script tags

But the thing is that even if I try to hide the script tags I still don’t get it how to execute the script 0.o

Mr. Cyph3r [MrCyph3r]
9 years ago

0

Well, it doesn’t delete all of the script tags… but I’m not sure what you mean by “all”.
The thing is it “filter out” the script tag :/ so you have to kinda fool the script.

p4p1 [lexostras]
9 years ago

0

I mean that it looks at the script tags and if it finds it, it deletes it so to bypass that I did something like this:

-helhellolo

Mr. Cyph3r [MrCyph3r]
9 years ago

0

So you are on the right track… you only need to find the exact method, actually there are many ways to get it done.

p4p1 [lexostras]
9 years ago

0

Hmmm thx I just found on the web this thing:

<script>alert(‘y0u ar3 0wn3d!’)</script>

And I sent it threw the box and it sent me just like before but instead of hackthis thre were the you are owned thing. So I am wondering what is the goal of this level is it to print out the script or to execute it? Because when I read the instructions J understand execute the script but maybey I am totaly wrong please help

p4p1 [lexostras]
9 years ago | edited 9 years ago

0

OH!!!! Tell me if I am wrong but to execute javascript do I have to use the console and does the filter work on the console?? Because I was just putting the code inside the text field without thinking about it….

Mr. Cyph3r [MrCyph3r]
9 years ago

0

The objective of this challenge is to have an output like this (as you see from the description):

<script>alert('HackThis!!');</script>

You don’t need the console, just use the input box and don’t think about executing the script, just think about the filtering… When you enter an input you will see the result on a gray box under the textarea, try to find a way to make it looks like the requested input.

And btw, copy & pasting strings from other websites will not work, you have to find the right pattern for this particular challenge ;)

p4p1 [lexostras]
9 years ago

0

Ok thx a LOT Ithink I am slowly getting it ill come back tomorrow good night for all of the memebers ^^

p4p1 [lexostras]
9 years ago | edited 9 years ago

0

Me again srry if I am a pain but it seems that I really can’t figure it out, I just found this in the script tags that were inside the output

``` (function(i,s,o,g,r,a,m){i[‘GoogleAnalyticsObject’]=r;i[r]=i[r]||function(){
(i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o),
m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m)
})(window,document,‘script’,‘//www.google-analytics.com/analytics.js’,‘ga’);

      ga('create', 'UA-34026704-1', 'hackthis.co.uk');  
      ga('send', 'pageview');```

And I wondered, is this normal????

p4p1 [lexostras]
9 years ago

0

I feel stupid I just got it the solution was under my nose thx a lot guys :)

Discussion thread has been locked. You can no longer add new posts.
1 of 14

This site only uses cookies that are essential for the functionality of this website. Cookies are not used for tracking or marketing purposes.

By using our site, you acknowledge that you have read and understand our Privacy Policy, and Terms of Service.

Dismiss