Axino.net

This one is much harder then previous missions especially because there are two logins and therefore looks like double trouble.

This is introduction to the first part of the mission:

This time Mr. Deitry decided to make a cookie login script and he said he decrypted it from ASCII encryption, and for you to login you need to encrypt it. And after you login there is another login but its a Login that uses SQL databases, but he thinks that the SQL login page is vulnerable to a simple SQL injection, and when he gets back from his vacation he would fix it.

Next I would like to point you to the site because encryption is from ascii to binary http://www.theskull.com/javascript/ascii-binary.html

Now let’s check cookies. You will find two cookies created by basic 7, username and password. Content of both is:

username: sam

password: jillisdead

Now let’s encode contents.

sam == 011100110110000101101101

jillisdead == 01101010011010010110110001101100011010010111001101100100011001010110000101100100

Now click to submit username. After you did this change values of the cookies. You will get to the following page http://www.hellboundhackers.org/challenges/basic7/check-cookie.php

Now after you have updated cookies, you just refresh page and you will see SQL login page. So now we need to use simple SQL injection,

‘ 1=1

And it works

Similar Posts:

• Basic web hacking 9 :: null poison byte
• Basic Web Hacking 16 :: SQL injection
• hackthissite.org basic 10 :: My cookie your cookie
• hackthissite.org basic 6 :: encryption system
• hackthissite.org solutions to all basic missions