First one ive been stuck on!

go to the source (as always) an follow the leads.

Can you go in dept I still dont understand

Could you be more specific? What exactly you don’t understand? Viewing the source?

probably which part of the surce should we be focussing on

The part that tells you where the script originates from… always do the background checks…

hey i’ve problem with that…. i have the .js file but there are no login / psw only numbers, its that coded?

again i find it.. but can some'1 tel me why when i put the link in to blackwindow and then scan the site, i can’t see the members file but only login.js

find the Index page - find [removed] try out the user names and passwords ;)

Edit: removed spoiler

Hey, I have found the members file through the hints but don’t know how to find the file without the hints Are threre any programs to scan for hidden files or soemething else or have I to guess a file with this name?

I also tried to get it through the source code but that won’t work. I used the hash method backwards to get username (t1gcg) and password ( pcccfgid). They are accepted because their hashcodes are like the ones in login.js but I see no way to decrypt the url this way. Are there any other hints to get the solution through the sourcecode?

best regards,
Mojito

The idea is to not attack the encryption directly but to try and find an easier way to avoid it. Seeing as it is a stock scrip there will be documentation somewhere. If you did some research into the script you might be able to find a possible vulnerability.

[flabbyrabbit]s comment was helpful. I found documentation and it was easy to do it then.

But is it even possible to write a function to decrypt it the hard way? I was trying hard to analyze the code and when I was close I reliazed u need the password to crack the hash no metter how u try to change script (removing some if statements ect.). You have the crypted info of username lets say 6432 and u need to do step1 few times. But since you don’t know the password, alpha.indexOf(password[x])) can be in range 0-70 (give or take). That means you can create some algorith wich will test XY candidates but you can’t crack it directly.

Am I right?

It would be too complex to explain it absolutely exactly (with my English even harder) but I hope I explained my general idea :)

step1: (username - 1 - alpha.indexOf(password[x])) / 8 (just basic idea - not the exact calculation)

Sorry but spoiler tag here is [ spoiler ] not < spoiler >

Is the documentation still online ? I don’t find it …

I pass all other level easily but this one … !