I have solved the level but how does this work?

Oh, the first question is solved, I have to go up in the directory becouse index.html / news.html are in /level6/pages/.

So my only question is, how the admin.php hides its sourcecode and why the sourcecode is there, if I whatch the file with the right methods.

Best regards,
Mojito

Hi Mojito,
I’m still trying to solve this level. I found the admin.php asking for the password only under /levels/real/level6/, the other ones
http://www.hackthis.co.uk/levels/real/admin.php and
http://www.hackthis.co.uk/levels/real/level6/pages/admin.php
are just copies of the levels index overview page http://www.hackthis.co.uk/levels/

I tried another way, and gave the princess home page navigator different input, like
http://www.hackthis.co.uk/levels/real/level6/?p=admin
This shows an interesting error message:
“Warning: file_get_contents(admin.html) [function.file-get-contents]: failed to open stream: No such file or directory in pages on line 22”

Are you sure you found the pw by looking at the source code of admin.php?
I could really use a little hint here..

Regards, Matrox

I’d like to know how you solved the level too… it seems to me that you don’t really understand how it works, but still managed to pass it. Did you watch a video about it?

Ah - seems I was on the right track there. I didn’t know how to point the p= to the right file. Googled it, found a video.
But I still cannot retrieve the admin.php source.. The ../ part doesn’t work.

“Warning: file_get_contents(../admin.php) [function.file-get-contents]: failed to open stream: No such file or directory in pages on line 22 ”

Regards, Matrox

did you watch the video until it finish , or you watch the video just to learn ?

I won’t type in the password until I do see the php.admin source in my browser window. That’s hacker code of honor - or how do you call that?
Matrox

hahahaha yeah… alright just do until you can complete it properly

If you guys still have doubts on how this works, feel free to pm me.
I’d like to post how it works here by it’d be a spoiler.
This is certainly a great place to train.

i was wondering to get the password do you have to do some SQL injection if so help

dont worry got it

if you read the rest of this thread, it answers it as well as can be answered without breaking forum rules…
read, think, analyse, learn, apply.