Welcome to HBH! If you had an account on hellboundhacker.org you will need to reset your password using the Lost Password system before you will be able to login.

real 2 script help


dnatrixene135's Avatar
Member
0 0

I'm not quite sure what the bounds are for this, but I know I have effectively crafted a url bruteforcer in javascript (through iframes) that will show me whether or not I have achieved the page.

I know that it is in the format backup_2004-09-01_1000.sql, where the 01 will change from 01-30 (I've even tried 31), and 1000 can change from 1000-2400 by adding 100 each turn, if I am correct, or maybe 0000-2400.

However, the briefing doesn't specify clear enough the limits of the mission. 1000-2400 by adding 1 each round? 01-30 or 1-30 or maybe all 2 digits 00-99? I know it says no minutes, but that isn't working for me.

My pseudocode

var i=****; var n=*;   //establish starting values: i=hours, n=day
while (i<****){           //loop the days per hour
while(n<**){

if (n<10){n="0"+n;}  // if days are 1-9, 0 added in front, similar with hours 0000-0900

//write <iframe> with the correct source, backup_2004-09-n_i.sql

n++;
}
n=1;
i+=100;alert(i);}       //tells me if there has been an error so far

My code doesn't seem to work. Any hints?

Thanks in advance! dnatrixene135 :ninja:


Rap70r's Avatar
Member
0 0

Son, your code works just fine. I test it in my server and it print the correct url to that file. and as you correctly assumed the hour rage is 1000-2400 and you correctly change the n (days) and add "0" if its lower than 10. Now, September has 30 days. so if we wanted to range the days we would write it like this:

01-30 which is: 01, 02, 03, 04, 05, 06, 07, 08, 09, 10, 11,…,30 and the hours like this: 1000, 1100,…,2400 you get the idea.

And as i said before, your code works correctly, you just increase the days for every hour xD but that's fine. Go assign those variable of your "i, n" correctly and hack that page son! :)

Good luck. B)

R@p70r.


dnatrixene135's Avatar
Member
0 0

Thanks for your reply, although I must ask another question.

Is it just "backups" or is there also "bacups" ?

****EDIT: solved it. Turns out to be a typo in my url path. Buggers. =(

BTW, it's just "backups". There's no "bacups".