8024_owasp

inspect the source
- no obvious attack surface is seen
- a lot of files are inaccessible, due to wrong file path

access the available file path /index_files to look for others files (see 8024_2.png)

the previously not found files aren't here as well, but a lastlogin.log file (see 8024_3.png)

decoding the file from hex ascii values results in binary code

01001100 01100001 01110011 01110100 00100000 01001100 01101111 01100111 01101001 01101110 00100000 01100010 01111001 00111010 00100000 01000001 01101100 01101001 01100011 01100101 00100000 01010000 01110010 01100101 01110100 01110100 01111001 00101100 00100000 01110101 01110011 01100101 01110010 01101110 01100001 01101101 01100101 00111010 00100000 01000001 01101100 01101001 01100011 01100101 00100000 01100001 01110100 00100000 00110001 00110100 00101111 00110011 00101111 00110010 00110000 00110001 00110001 00100000 00110001 00110000 00111010 00110101 00111001 00111010 00110000 00110000 01100001 01101101

this binary code translates to Last Login by: Alice Pretty, username: Alice at 14/3/2011 10:59:00am

inspect the cookies to find the session cookie 64489c85dc2fe0787b85cd87214b3810.0
- the first value resembles an md5 hash, reversing it results in Alice
converting the string Admin to md5 results in e3afed0047b08059d0fada10f400c1e5
replacing the md5 for alice with the one for admin results in the page refreshing and resetting the cookie to the one before
changing the .0 to .1 as well (in addition to admin hash) results in the challenge to be completed (and the cookie to reset again) (see 8024_5.png)

the admin password is still unknown (but the challenge is complete, as we successfully impersonated the admin)
(there isn't even a possibility to input a password)

8024 OWASP Hackademic Challenge 7

attack:

result: