Realistic 1 Walkthrough

Realistic 1 Walkthrough

By ghost | 16532 Reads |

0     0

Realistic 1 Walkthrough Hi Everyone I wrote this tutorial because i did not think that any tutorials for realistic one where indepth enough.I would say this deffinitly contains spoiler so be warned and it is rather long!

So the first thing we see is the JohnDoe password and account yes that is handy!So upon arriving at the log in we chance a shot of sql injection just in case ' hmmm that didnt work!So now we simply log in and while youre at that go back to youre mission brief and what does it say?

Your goal for this mission is to log in as an registered user (johndoe/password) and analyze the site to gain administrator rights to change the price of the program to make it a lot more cheaper.

Now what are the key parts?We have to analyse the site and make the program cheaper,So what does analyse mean?Yes you guessed it!Look at something realy in depth.Now i am sure you have learned by now to look at the source and when we open her up what do we see?

Not that much!Yep its pretty bare so maybe thats a good thing lets look in the directorys given to us….. Hmmm you see it?Yeh thats pretty interesting! But now that we have this what do we do?We cant use sql injection to get in because we tried that…..Hmmm??Maybe javascript injection…..

Well first of all what is Javascript injection?Javascript Injection is simply changing the content of things such as cookies using JavaScript.Ahh now you see what I am getting at.

So to do this goto youre url and remove www.whateverpagethisis.com/hah/a0tuhah/a0tu!

Now type in javascript:alert(“hello”) and hit return….Tada! But wait dont get too excited we are not even at the good bit yet!Try typing javascript:alert(document.cookie) hmm interesting!Hmm That AuthId is interesting aint it?It couldnt possibly stand for authorisation id…Or could it??Well hmm i wonder what we can do!

In administrator.txt we found some interesting info(yes i changed the info so stop being so lazy)

administrator password = pass

status:administrator

AuthID: authid

So lets use it :D Lets up our AUTHorisation :D So we know how to do a javascript command and what not through our browser so lets do it: javascript:void(document.cookie=AuthID=“authid”);

So basicaly what we are saying is that in that cookie change the AuthID bit to this,Yes i know rather simple but it works….Now what page is the price on??Well that means its probably best to do it on that page but i dont think that software is real anyways so its probably not worth more than a dollar!

And ennjoy the 35 points,Sorry it was so long but this is how i learn best and if you dont like it dont read it :) .And if you do like it please rate it and leave comments!(motivation to do more) Enjoy Shouts:http://www.a0tu.com , The Flash and BobbyB ,n3wtyp3 and tmc :)