Axino.net » Arxleol

hellboundhackers.org tracking challenges solutions to all missions

Arxleol — Thu, 15 Jul 2010 12:45:00 +0000

Just for the legacy sake I am posting all solutions in one post as always.

Similar Posts:

Tracking Challenge 2 :: Intruder tracking

Arxleol — Thu, 15 Jul 2010 12:13:42 +0000

Second tracking mission requires from us to track down intruder. If you open site you will see that site was defaced by hacker. Notice that on the right side we have links to other pages on this government site.

If you try opening any of these pages you will see that all of them were changed by hacker. Now notice that opening new page appends variable action in the URL. So considering where all actions are saved (probably in system logs). Let’s try accessing that page.

However, when you open index.php?action=logs you will notice message from hacker that he obviously deleted all logs.

But if you check source of the page you will find interesting comment.

Now, that we found IP of intruder let’s track it down using: http://www.ipaddresslocation.org/ip-address-locator.php.

Similar Posts:

Tracking Challenge 1 :: Email tracing

Arxleol — Wed, 14 Jul 2010 19:45:17 +0000

If you read my previous tutorial then you should already be able to solve this challenge.

When you enter your email address preferably gmail, you will receive following email:

This a automated email, sent out by HBH Tracking Challenge 1: For this challenge you must enter the IP + host in the challenge page

Now open original message and there you will be able to find in Received section information about domain: s15265096.onlinehome-server.info and ip:87.106.143.53Similar Posts:

How to trace emails using Gmail

Arxleol — Mon, 12 Jul 2010 21:41:47 +0000

Tracing emails is really simple using gmail.

Open any email you received and check the arrow pointing downwards on the right side of email box. When you click on the arrow select option: Show original. This will open new window with original message.

In the received part you will find domain name from which message was sent and what is more important IP address of sender. So you could either trace email to sender or verify whether sender is who he claims.

Another useful part worthy of checking is Authentication where you may see how Google authorized sender.Similar Posts:

JavaScript Challenge 15 :: nag a ram

Arxleol — Sun, 04 Jul 2010 01:10:22 +0000

This mission is interesting and a bit harder to solve, because we need to actually solve it and cannot use some simple way of outputting finished password.

Javascript actually generates password from riddle or even better anagram.



// Written by SlimTim10
// Hint: The answer may be more than one word and may contain spaces.
 
function checkpassword()
{
 
	password = document.password.password.value;
	var a = password.charAt(9)
	var c = password.charAt(4)
	var b = password.charAt(10)
	var d = password.charAt(7)
	var f = password.charAt(6)
	var e = password.charAt(1)
	var g = password.charAt(3)
	var i = password.charAt(0)
	var h = password.charAt(8)
	var j = password.charAt(13)
	var l = password.charAt(5)
	var k = password.charAt(6)
	var m = password.charAt(11)
	var o = password.charAt(12)
	var n = password.charAt(2)
	var riddle = "query test mess";
 
	if (a+""+b+""+c+""+d+""+e+""+f+""+g+""+h+""+i+""+j+""+k+""+l+""+m+""+n+""+o==riddle)
	{
		alert("Congratulations!");
	}
	else
	{
		alert("Wrong, but keep at it!");
	}
 
}

To solve it I used piece of paper. First I draw 14 boxes starting with zero till 13. Next step is to copy anagram: query test mess. And write below each letter, letters from a to o.

Now you need to fill boxes with letters let’s solve it for letter a.

Over letter A is letter Q and now we check javascript code: var a = password.charAt(9) so letter a should be in box 9 so fill the box 9 with q.

Simple or not. Here is interesting and surprising final answer: system requestSimilar Posts:

JavaScript Challenge 10 :: Math time

Arxleol — Sat, 03 Jul 2010 16:16:20 +0000

We will solve this challenge as we already used to solve some others. Simply by executing javascript in your browser and checking result.

So very first step is to find javascript that will be executed when password is entered.



 //By system_meltdown
 function checkpass()
 {
 pass=document.password.pass.value;
 rawr=unescape('%61%68%6f%79');
 string="llama llama duck!";
 a=string.charCodeAt(1);
 b=string.charCodeAt(7);
 c=string.charCodeAt(4);
 schloob=((60*50/3*a)-(b*c))/2/5+b;
 asdf=rawr+"_"+schloob;
 if(pass==asdf)
 {
 alert('Wahoo you got it!');
 }
 else
 {
 alert('Awww shame!');
 
 }
}

Now for executing we will take just the important part of code:



rawr=unescape('%61%68%6f%79');
 string="llama llama duck!";
 a=string.charCodeAt(1);
 b=string.charCodeAt(7);
 c=string.charCodeAt(4);
 schloob=((60*50/3*a)-(b*c))/2/5+b;
 asdf=rawr+"_"+schloob;

Executing script in your browser is easy. Just open new tab and in the URL bar enter following javascript code. Notice that I am alerting value of asdf variable.



javascript:rawr=unescape('%61%68%6f%79');string="llama llama duck!";a=string.charCodeAt(1);b=string.charCodeAt(7);c=string.charCodeAt(4);schloob=((60*50/3*a)-(b*c))/2/5+b;asdf=rawr+"_"+schloob; alert(asdf);

Now you should receive this password as result.

ahoy_9860.4

Similar Posts:

Brainout

Arxleol — Wed, 23 Jun 2010 21:56:25 +0000

Hello, I’d like to present my latest project named Brainout. It is for collecting feeds from different sources and allowing other users to Trek down you on different channels.

Current version of project is available here: brainout.axino.net

If you search for brainout and trek it then you’ll be able to see collection of twitter feeds and rss from axino blog.

If you have any feedback I’d really like to see it.Similar Posts:

JavaScript Challenge 14 :: Simple answer

Arxleol — Thu, 10 Jun 2010 21:44:40 +0000

Sometimes the simplest answer is the correct one. Obvious when you examine this challenge you will find following javascript:



a = screen.width;
if(a != 800)
{
 alert('Sorry you do not have the right parameters!');
}else{
 window.location='/challenges/js/js14/index.php?ans=1e799d6ab6736c258580e7bc9feebacb'
}

Now you probably notice that you should have screen resolution of width 800 pixels. However, if you check else statement you will find new location and if you use it you will solve this challange.

So jump to this URL: index.php?ans=1e799d6ab6736c258580e7bc9feebacbSimilar Posts:

JavaScript Challenge 13 :: Cookie

Arxleol — Tue, 08 Jun 2010 22:28:17 +0000

We will solve this challenge with Firebug. Open challenge page in Firefox, and start Firebug. Now you probably see this sentence:

You are not authorized to view this page!

however, checking source code you will find that page is using cookie for authorization named authorized with value: false.

So if you are already in Firebug just open Cookies tab find cookie named authorized right click on it and select edit. Now just change false into true and reload page.Similar Posts:

JavaScript Challenge 12 :: execute

Arxleol — Tue, 08 Jun 2010 21:53:50 +0000

I know, when you opened this challenge you probably though again some math problem. But this one can be solved very easily.

Script that awaits you is long and it would be boring to analyze it. You already noticed that you cannot use javascript injection.



function checkpass()
{ 
 
 pass=document.password.pass.value;
 z=2;
 x=z*1.5;
 v=z*2;
 w=v*1.75;
 y=v*1.25;
 abc=(((y*v*y*x+z)*x+w)*z+y)*v+w; 
 
 if(pass==abc)
 {
  alert('Congratz! You are good at Math');
 }
 else
 {
  alert('Sorry, try again when you learn more Math!'); 
 
 } 
 
}

So what we want to do is to execute mathematical part and obtain answer. You can do this by opening new tab and executing following script that will output correct mathematical answer:



javascript:z=2;x=z*1.5;v=z*2;w=v*1.75;y=v*1.25;abc=(((y*v*y*x+z)*x+w)*z+y)*v+w;alert(abc);

You should get this answer in alert box: 7331Similar Posts: