Basic 28
At first glance I was thinking it might be email injection…where you could inject additional headers in the $name or $from variable or whatever it may be, but I can't wrap my head around how I could use email injection to get a pass. Oh well, maybe I'll try some more later, I haven't touched a challenge in quite a while.
Uber0n wrote: [quote]jjbutler88 wrote: I dont get it, does this challenge actually send emails? Nope, it's a simulated challenge ;) I've got a few ideas now, just need to test them… (and I really don't think it's about about XSS)[/quote]
Erm, yes it does send emails actually… lol, not simulated. But thanks for guessing!
system_meltdown wrote: [quote]Uber0n wrote: [quote]jjbutler88 wrote: I dont get it, does this challenge actually send emails? Nope, it's a simulated challenge ;) I've got a few ideas now, just need to test them… (and I really don't think it's about about XSS)[/quote]
Erm, yes it does send emails actually… lol, not simulated. But thanks for guessing![/quote]
It does? So, as a part of the challenge I should be receiving an email? Or no?? Becuase it's not sending me the email. This only furthers my suspicions that the object is to use email injection of some sort.
slpctrl wrote: [quote]system_meltdown wrote: [quote]Uber0n wrote: [quote]jjbutler88 wrote: I dont get it, does this challenge actually send emails? Nope, it's a simulated challenge ;) I've got a few ideas now, just need to test them… (and I really don't think it's about about XSS)[/quote]
Erm, yes it does send emails actually… lol, not simulated. But thanks for guessing![/quote]
It does? So, as a part of the challenge I should be receiving an email? Or no?? Becuase it's not sending me the email. This only furthers my suspicions that the object is to use email injection of some sort.[/quote]
It's a form to contact the admin, so why would it send you the email? :p
system_meltdown wrote: [quote]slpctrl wrote: [quote]system_meltdown wrote: [quote]Uber0n wrote: [quote]jjbutler88 wrote: I dont get it, does this challenge actually send emails? Nope, it's a simulated challenge ;) I've got a few ideas now, just need to test them… (and I really don't think it's about about XSS)[/quote]
Erm, yes it does send emails actually… lol, not simulated. But thanks for guessing![/quote]
It does? So, as a part of the challenge I should be receiving an email? Or no?? Becuase it's not sending me the email. This only furthers my suspicions that the object is to use email injection of some sort.[/quote]
It's a form to contact the admin, so why would it send you the email? :p[/quote]
Ah alright :p
It's a form to contact the admin, so why would it send you the email? :p
Ive just done it! Read the sentence over and over until you get the idea…. :p
@system, what %age of sites out there are vulnerable (?) to this? Never really thought of it, but seems like it could be useful.
jjbutler88 wrote: [quote] It's a form to contact the admin, so why would it send you the email? :p
Ive just done it! Read the sentence over and over until you get the idea…. :p
@system, what %age of sites out there are vulnerable (?) to this? Never really thought of it, but seems like it could be useful.[/quote]
Well done :) And erm, not sure, quite a few are though :p
jjbutler88 wrote: [quote] It's a form to contact the admin, so why would it send you the email? :p
Ive just done it! Read the sentence over and over until you get the idea…. :p
@system, what %age of sites out there are vulnerable (?) to this? Never really thought of it, but seems like it could be useful.[/quote]
Im reading this thing over and over and over but stiill can't figure it out. Something about sensitive data im guessing. but don't know.
Ok, so excuse my hat turning a little black for this question, but wouldn't this work in say - password recovery forms? Thats a pretty damaging vulnerability then.
@shadowls - The admin doesn't want you to get the email, but you want it. Really dont want to spoil it just think how you can get that email…
jjbutler88 wrote: Ok, so excuse my hat turning a little black for this question, but wouldn't this work in say - password recovery forms? Thats a pretty damaging vulnerability then.
@shadowls - The admin doesn't want you to get the email, but you want it. Really dont want to spoil it just think how you can get that email…
What email? Should I get the email that I just put before? I don't get it…:(
i saw smth like that (i think on hackthissite) i had to use source editor just to change e-mail(because it was sending passwd to one e-mail) so maybe i think i need to change e-mail (but there is no e-mail in source so maybe there is some script or i have to inject smth like SSI (but i think that SSI will not work here) or smth else if i am wrong dont listen me (i am just thinking loud) and if this is spoiler delete this but i thin this is not a spoiler
first thing i tried was a packet sniffer to see if there was a hidden message somewhere. that didnt work. Going back to the challenge to see what's up now. BTW can i please please get my 3k points back… I can't even get the points from the pen testing now cuz i already got them before but they're not added up into the total points