Basic Web Guide
Version 2.2
July 4th 2007
Table Of Contents
- Introduction
- Common Errors and Problems with Basic Missions
- Before you Begin
- Basic Mission 1
- Basic Mission 2
- Basic Mission 3
- Basic Mission 4
- Basic Mission 5
- Basic Mission 6
- Basic Mission 7
- Basic Mission 8
- Basic Mission 9
- Basic Mission 10
- Conclusion
Introduction
For those of you that have questions after reading this, or before reading this (if they are specific) please do post them. We will gladly help you out. This guide is simply meant to help those who need a little bit of help on the missions, without the use of spoilers.
Remember, when posting a question, please make the thread title specific, and give a good description of your problem. And please please please write in proper English. Its really not that hard. You will get much faster and friendlier answers by doing so. And as always, do tell us what you’ve tried, and what was the outcome of your attempts.
Of course, I am not the expert. Just a local HTS member that spends too much time in these forums. This one especially. For those of you who have read my article on basic missions 1 to 3, this guide is intended to replace it. I prefer posting a thread – and hoping it will get sticky’d – then to release another article. Since I have freedom of BB codes here, and its much easier for replies to be made, and for others to refer to this post. ed note: buz originally pinned this topic in HTSv2 and since then, it has become an integral part of the HTS Basic Web Missions
Common Errors and Problems with Basic Missions
Hackthissite.org has a few problems with the basic missions that should be mentioned beforehand, as it might help solve that question you have.
The first thing you may ask is why do you always have to redo the missions you’ve previously completed every time you log back in. Well the answer is, you don’t. You can easily skip the missions you’ve completed by changing the URL to jump to the last mission you completed. This will not, however, allow you to skip ahead of missions you’ve not yet completed. Doing so will present you with a password box for the current mission you are on, and wont give you the mission details and information you need to complete the mission.
Basic Mission 1
Sometimes the source code doesn’t appear. All you get is an empty notepad page. To resolve this, close notepad and your web browser, and try again. As far as I am aware, this only occurs on mission 1.
Basic Mission 2
In mission 2, instead of displaying an ‘Incorrect password’ warning, all you receive is a blank page. Anytime you see this – in any level – this means the password is incorrect.
Basic Mission 4
When trying to send the email are you getting an error saying that you’re banned due to spamming? This is because the HTS mail server does actually send emails and the script could be tricked to send emails to an arbitrary address (in fact this is what you’re doing). Without this restriction the script would be used to mail bomb someone. The ban will automatically be lifted in 15 minutes or so. Have a short brake. ed note: Paragraph borrowed from Sid
Basic Mission 4/5
For those of you with hotmail.com accounts, for mission 4 and mission 5, you will receive the email in your junk folder. The email is from ‘Sam’ and has a single sentence containing the password. For those with gmail.com accounts, 99% of the time, you will receive an ‘IP/email address banned for flooding’ error. This doesn’t really ban you, so just go back and try a non-gmail account if you have one. I know you have one, seeing as the only way to obtain a gmail account is through invite.
As well, if you have a software firewall, you might experience difficulties with mission 5, receiving “invalid referrer” errors even after you have entered the correct Javascript code. To solve this, disable your firewall temporarily.
Basic Mission 7
The command ‘dir’ should also work however, in this mission, it does not.
If you have any other errors you would like to report, simply PM me and I will check it out.
Before you Begin
Most of HTS’s missions are based on internet hacking. So you don’t need a very profound knowledge of computers. You do need, however, knowledge on internet and networking. Seeing as the internet is just a collection of millions of networks, books about internet and networking go hand in hand.
Before you even attempt mission 1, there are a few things you need to know. The essential being HTML. No you do not need to be an expert in HTML, but you need to know the basics of HTML. For example, some of the codes, how to edit and create HTML documents. And how to view the HTML source code of a webpage.
w3schools.com can provide some good information on HTML, as well as other web related topics.
If your goal is simply to get by the HTS hacking missions, your knowledge need only be as far as internet and networking, as I mentioned above. But the world of hacking extends far beyond the internet. Hacking extends to computers that are not part of the internet, or simply hacking someone’s personal computer. Although at this stage it is more for the purpose of stealing and causing damage, it is none the less, part of hacking. For this you should also have a decent grasp on general computing knowledge, such as hardware and software, operating systems, domains and trusts, policies and permissions, and much more. Again, you don’t have to be an expert, but you would have to become one. I will leave this as is, because I am straying away from the objective of this guide, getting by the basic web hacking missions. For more information about beginning hacking in general, read this article. Ed note: This article was a mini “guide” to starting your hacking career which contained many references to books and web links. This thread was lost when forums.HTS moved and became CS.net
Ok, now onto the missions!
Basic Mission 1
Knowledge required:
- basic HTML
Sam, the network security agent at some random company has created a password for users to access information on the company’s website. This is made to prevent just anyone from accessing the site. Only those who know the password can enter. But Sam is fresh out of tech school and doesn’t have any experience. So he’s made a grave error in the way he handled the implementation of the password.
Basic Mission 1 is called the idiot test. Simply put, if you cannot beat it on your own, don’t worry, I came to the forums looking for help too. Although I knew how to finish the mission, I just wasn’t thinking the right way. This is something you will learn in these missions, its not just what you know, but what you do with that knowledge. Sometimes all you need is a push in the right direction.
If you’ve ever created a webpage on Angelfire or Geocities, then you know how to finish this mission. You just need that “push in the right direction”. If you haven’t, then thats ok. Sam made an error when he created the password feature. We have to find that error. The first place to start looking for would be in his code. Perhaps he left us a clue there.
NOTE: If you still don’t know how to beat this mission, I strongly suggest reading up on some basic computing and basic internet. Books such as those I mentioned in this article. Ed note: This is the same link as previous. To fully understand and enjoy this mission, I suggest you do sign up for a domain at Angelfire or Geocities and experiment with some HTML.
Basic Mission 2
Knowledge required:
- basic HTML
- ability to think logically
Sam has gotten a tad smarter. Experience always comes from experience is what I say. Sam decided to create a text file with the password in it. So that the edit box will read from that file, and match what you typed in to that password stored in the file. There’s only one problem. Sam forgot to upload the file. So then, the edit box will be comparing the password to nothing.
For those seeking a better understanding. Look at this:
(IMG:http://img.photobucket.com/albums/v637/WildCard832/level2.jpg)
One thing I always try and do is submit the password field blank to see what kind of error message it will give.
Basic Mission 3
knowledge required:
- decent amount of HTML
Ok, same concept as basic mission 2. Except this time, Sam remembered to upload the password file. The corporation he’s working for should fire him. Poor Sam. Ok, so we know the edit box will compare what you type to the password file. So this means that the edit box must know the location of the password file. So lets see if we can find out were that is.
Again, a pretty diagram:
(IMG:http://img.photobucket.com/albums/v637/WildCard832/level3.jpg)
Basic Mission 4
knowledge required:
- decent amount of HTML
- directory structure
This time around, Sam decided to make use of a little bit of programming in his attempt to keep hackers at bay. He created a little script that would send himself the password in case he ever forgot it. You see, Sam is the type of guy that goes to the grocery store with a paper list of items to buy since he cant remember what his wife told him before he walked out the door some 20 minutes ago. (Little bit of humour)
So not only is Sam a poor network security technician, but he’s also got a bad memory. I have to wonder how he got hired sometimes.. Lucky for us, Sam left us a nice big (sorry, its not red) button for us to press to send Sam the email to his account.
We can get the password if we hacked into Sam’s email account. So we need to know his username, domain name, and password. A quick look at the source will reveal to us his email address, which contains his username and domain name (username@domainname.com). Now we just need to figure out his password. But there’s a problem. If we hack into his email, he’ll know someone got his password, and we don’t want that. And on top of that, we don’t know his email password. So thats even more trouble. But we like to keep things simple.
Do you have an email account? Hopefully, you answered yes. (If you answered no, you need help) Now, lucky for you Im assuming you know the password to your email account too right? Yes you do.
Need I say more on this? No.
Now as for directory structure, you cannot move the location of a webpage and expect it to still refer to the real pages at the original location. Its like if you made a shortcut to a game, and then changed the location of the original file. The shortcut would no longer work. The real terms for this are called absolute path and relative path. You can easily google those terms for extra help.
Here is an example:
(IMG:http://img.photobucket.com/albums/v637/WildCard832/HTTPchart.jpg)
This part is always so hard to explain yet so simple to understand. The keywords to remember; Absolute path, and relative path.
Basic Mission 5
knowledge required:
- decent amount of HTML
- basic understanding of how information moves around the internet
- basic Javascript
- Javascript Injections
Ok, so Sam has gotten smarter yet again. (And so have you!) He modified his level 4 password script to make it a little more secure. This is why IT technicians get paid the big bucks. To stay one step ahead of hackers. But your job as a hacker, is to find vulnerabilities, learn them, and exploit them. Maybe Sam should get a raise now.
For those who have read my previous article, I list several books which I have read. One of which, is ‘How Computers Work: Millennium Edition’ by Ron White. If you turn to page 342, you’ll see a nice diagram of how network communications work. I have re-created a diagram to explain this for our situation in level 5.
When you send data over the internet (or any form of network, local or otherwise) your computer sends two major pieces of information. The header and the data. The header contains two important values. A “to” value and a “from” value. The “to” value indicates who the information is addressed to. If you wanted to go to Google’s website, the “to” value would be http://www.google.com. The “from” value contains two pieces of information. The first is what computer is sending the information, so in this case, Pilot’s computer, and the second, is the type of web browser, and current URL address of my browser. So if I was on HTS’s webpage, it would be http://hackthissite.org. Just like on a birthday card! To: From:
So our header is launched towards Google’s homepage. From there, Google knows who to send it’s information back to, because of the “from” value in the header. Google’s header would have a “to” value of Pilot’s computer and a “from” value of http://www.google.com.
Ok, so now that we know what a header is, the second part is the data. This is what you are sending. If you typed into your URL address bar Google’s website, then the data would be a request to see the webpage. Google’s data in return would be it’s homepage so that it can be displayed on your browser. Thats how computers communicate over networks, local, and wide.
Back to level 5. What did Sam do to make his level 4 password page more secure? He created what is called a referrer. A simple piece of code in the webpage’s PHP that tells the server that if the webpage comes from a certain address, then it can send the email to whatever address is in the HTML code on the webpage. If the referrer doesn’t match the information in the header, then Sam’s server will return an error message.
(IMG:http://img.photobucket.com/albums/v637/WildCard832/level5.jpg)
In level 4, to change the email address, you had to save the source code onto your computer, thus changing the “from” value in the header. But in level 5, this will result in an ‘invalid referrer’ error. So we need a way to change the contents of the webpage without saving the source to our computer. In comes Javascript. An internet programming language on the client side of a webpage. Client side meaning that it modifies the webpage on your computer. Not on Sam’s server.
So using Javascript, we need to change Sam’s email to our own email. That way, we wont tip off Sam’s referrer because the page is still being executed from the same location, and we’ll be able to receive Sam’s password.
*New* If you want to gain a little more experience with Javascript, I suggest you look over the missions here. (Ed note: This link seems to be down, I will try fix this) If you can manage to get up to mission 10 (I think) then you are good to go. Although you don’t have to, the first few missions will give you a general idea of what Javascript is.
For more information, you can read the Javascript injection article. However I must point out it contains spoilers. It contains the exact Javascript code you must use. Don’t say I didn’t warn you. Here it is.
Basic Mission 6
knowledge required:
- ASCII
- pattern recognition (logic)
Sam is getting smarter and smarter. But so are you. For every wall he builds, you successfully climb over it. Sam has yet again decided to take a new approach to his password protection. Not with HTML, not with Javascript, but with encryption. He created an encoder that would encrypt his password. This way, if he ever forgot the password, all he would need was the encrypted password and he would decode it using his decoder (which we don’t have access to)
However, we did manage to acquire his encrypted password. Even more lucky for us, we found his encryption program too. However, it is not a decoder. It is an encoder. So we cannot simply put in his encrypted password and get his real password. But perhaps there is another way…
For those of you who like math, simply think of this equation: A+2=4. The method used to solve that equation is the same you would use to solve this encryption problem.
Basic Mission 7
knowledge required:
- basic Linux (or *nix Operating System) is optional
- experience using MS-DOS is optional
- UNIX commands
- directory structure
As I said earlier, Sam is a graduate from tech school. While he might still be new to the security scene, he still has some other valuable knowledge. And he has begun to use it. Most of us are running Windows on our computer. On Sam’s server, this is not the case. We don’t know exactly what Operating System he is using, but we know it is a *nix OS and that both Linux and UNIX operate on UNIX commands.
When I say they operate on UNIX commands, think of it like MS-DOS. (Just as extra knowledge, MS-DOS stands for Microsoft Disk Operating System) DOS is the actual Operating System of Windows 3.x, Windows 95/98 and Windows ME. Those Windows are simply Graphical User Interfaces (GUIs) to DOS. Since DOS is not GUI, it isn’t as user friendly as Windows. But those versions of Windows cannot exist without DOS.
Now in DOS you can do magical things. You can copy folders and file from one place to the next, you can view the contents of a directory (AKA folder in Windows terms) you can change directory, and you can format your drive (don’t do that though). You can also do plenty of other things, but that is straying away from the goal of this mission.
In a *nix Operating System (*nix meaning either UNIX or Linux) they have their equivalent to MS-DOS called the console or shell. The console resembles DOS and uses many of the same commands. But it also has some of its own commands that DOS does not recognise, in fact, many.
Now, why is this important to the mission you might ask. Well, simple. If you remember back to level 5, Sam used PHP (PHP Hypertext Pre-processor) to execute a script on the server-side (meaning on his server) and then send out the page to your computer (the client) with a referrer. The referrer was in fact a PHP command that was executed before the page was sent out to you.
In mission 7, Sam again uses PHP. This time, the script launches a query to you. It is asking you to input a year so that it may display a calendar. What is in fact happening is that the page is attaching whatever you enter into the edit box to a UNIX command and sending that back to Sam’s server to be processed. After that, it will return to you with the calendar for the year you entered, in other words, the result or output of that command.
Now this is where having experience with both MS-DOS and Linux (or UNIX) helps. If you have experience in DOS, you understand how this type of problem is handled. If you have Linux or UNIX, you can in fact try out the UNIX command for displaying a calendar.
Here is how the calendar command works.
(IMG:http://img.photobucket.com/albums/v637/WildCard832/level7.jpg)
The command cal can be used with a year value just like you are required to use, or it can be left alone, and then it will return a calendar for the current year and month. There is, however, one problem that Sam didn’t address. The word ‘cal’ is only the first part of the command. What you are typing in the edit box is also part of the command. Meaning you are typing a UNIX command that will be executed on Sam’s server. Aha! Now we know how to exploit mission 7.
Onto the problem. Sam has hidden the file in an ‘obscurely named file saved in this very directory’ to quote the mission statement. What does obscurely mean? Well a quick search of dictionary.com revealed this:
QUOTE
Not readily noticed or seen
So that means Sam didn’t save the password to password.php like he did in level 3. So don’t think you can guess the webpage that the password is located in.
But we also know that the password file is located in missions/basic/7 directory. So we have access to a UNIX console where we can input commands, and we have the directory where the password file is located. And lucky for us, that directory is the current directory. Meaning the directory we are on. So we wont have to change directory. So why don’t we try and find a way to see what is contained inside the missions/basic/7 directory.
Basic Mission 8
knowledge required:
- Server Side Includes (SSI) language
- basic programming knowledge, optional
Sam took a different approach this time. He still put the password on his server. Now, since he was using UNIX last time, it’s safe to assume he hasn’t changed.
The problem now is this. In mission 7, a PHP script was called that would execute a UNIX command on Sam’s computer. The first part of the command was already entered, cal. The second part of the command was the year which you entered. Well, were supposed to enter. But we exploited his script to our advantage by executing our own code.
In mission 8 however, Sam’s PHP script doesn’t execute a UNIX command. In fact, there seems to be no way for Sam to have access to the password himself (I guess HTS forgot about that part) He did, however, upload a PHP script that his daughter wrote. A simple script that inputs your name into a string variable and then counts the numbers of characters and stores that in a integer variable. Then a page is created in a directory called /tmp which stores .shtml files (Scripted HyperText Markup Language) These files use Server Side Includes to change the contents of the page to include your name and the number of characters in your name.
Basic Mission 9
knowledge required:
- Server Side Includes (SSI) language
- ability to think logically
Sam hasn’t learned a thing between mission 8 and mission 9. How did you get the password in mission 8? Well, think. How will you get the password to mission 9?
Although this mission is extremely easy, I feel it is also very important. Even I learned something out of it.
Basic Mission 10
knowledge required:
- Javascript
- what are cookies and how they work
Internet cookies are simple files that a website saves onto your computer when you visit the site. This is so the next time you visit the website, it will remember who you are. The most common example of this is on websites that require a username and password, such as HTS, Myspace, ImageShack, Hotmail (and every other email site). They will store a cookie on your computer so that the next time you visit the site, you don’t have to re-enter your username and password. That is how the little checkbox “remember me?” works.
(IMG:http://img.photobucket.com/albums/v637/WildCard832/level10.jpg)
However, don’t confuse this with Windows’s username and password saving feature. When you type in a new username and password to a website, Windows offers to remember it. This way, when you type the username, it will automatically add the password for you. This is not related to cookies.
Ok, now that we know a little bit about cookies, lets work on the mission. Sam, in his final attempt to keep you out of his site, has turned to using cookies. No more hidden password files to worry about. Unfortunately, Sam’s cookie is not stored permanently on our computer, so we cant go out looking for a file and changing it. So then, how do we change something if there is no file to edit. HTML? Good try, but no. HTML is the source of the webpage. Cookies are not part of the actual webpage. So how do we change the value of the cookie? Javascript you say? Yes!
Remember back in mission 5 how we used Javascript to modify the email value on the webpage so that we could receive the password? We used Javascript. Well, now we need to change the value of a cookie so we can have access to Sam’s site.
In using this method, Sam made it easy for his employers to access the website, and difficult for hackers to get in. Sam’s employers have an ability that Sam doesn’t have. The ability to remember their damn passwords!! So they need only enter it into the password box and then get into the site, skipping the whole cookie process. However, if the password is entered incorrectly, they are sent to another page where a cookie is created so the site remembers they no longer are authorized to the site. Unless they go back and enter the right password.
Onto the objectives. Forget about the password. A hacker always finds the easiest way into something. Just like in mission 4. You chose to have the password sent to your email rather than try and get into Sam’s email account. Now in mission 10 you’ll choose to modify the cookie to accept you rather than try and guess the password.
I will give you one hint however, this is your choice to view it or not. However even if you do view it, it wont give the answer away. This Javascript command could prove useful:
» Click to show Spoiler – click again to hide… «
java script:alert(document.cookie);
ed note: Spoiler tag is now working
Conclusion
I hope this has provided you with that “first step in the right direction” without giving too much away. If you have read this, and still cannot continue, please feel free to post in this forum. We are here to help you. Don’t feel stupid even if the question is “I’ve read the Basic Web Guide and still don’t get level 1″ Trust me, there are others that are in the same situation as yourself.
Now that I have beaten all the missions, mission objectives will be posted soon for the remaining missions (8 and 10). Look out for those.
Happy learning,
Pilot
:\kikicoco\Hacks\Tools\dicts\Wordlis
60*50/3*a)-(b*c))/2/5+b;
“;
).
. Also please note that this might be a spoiler but I tried my best not to make it one.
. Good luck! XD
Bình luận mới