8018_owasp

perform wrong login
extract progId from page meta tag: <meta name="ProgId" content="YXBwc2VjX3VzYTp0aGlzZWFz">
base64 decode the progId: echo 'YXBwc2VjX3VzYTp0aGlzZWFz' | base64 -d
- result: appsec_usa:thiseas
login with the found credentials (see 8018_1.png)

inspect page to find the email address
- the icon in the special clients mailbox is located under ./secret_area_/mails.gif
access http://hackademics.hacking-lab.com/ch001/main/secret_area_ (actually accessible without credentials, as it is just a honeypot)

access http://hackademics.hacking-lab.com/ch001/main/mails.txt (without the secret_area_) (also accessible without credentials, but seems legit)

  Crazy Alice Alice@InWonderland.com
  Nebu Chadnezzar NebuChadnezzar@OldKing.edu
  Jo Raimontilinekergrobelar ShortName@badmail.com
  Web Killer WebMurder@killer.ever.com
  Don Quixote windmill@mail.spain 
  Crazy priest Exorcist@hotmail.com
  Jasson Killer Friday13@JasonLives.com
  Everything All AllweSaid@mail.com
  Thiseas Sparrow Pirates@mail.gr
  Black Dreamer SupaHacka@mail.com
  Bond James MyNameIsBond@JamesBond.com
  Poor Boy Millionaire@fmail.com
  Blind Lynxeyed Linxblind@siou.com
  Earl Dracula CarpathianServers@Blood.com
  Tea Coffee sugar@dring.com
  Whisky Vodka drink@drunk.com

from the given list of email addresses Friday13@JasonLives.com seems to be the most promising, as the contact was hired on a Friday the 13th.
as this email probably isn't an external publicly registered address, the internal mail service has to be used to reach the contact
- send an email (see 8018_2.png)

challenge is completed (see 8018_3.png)

the contacts email address is: Friday13@JasonLives.com

in a real world example, sending an email from this sites internal mail service would probably result in the status of the contact to change from "special client" to "supplier" (aka getting killed and used as organ "donor")

8018 OWASP Hackademic Challenge 1

attack:

result:

annotation: