Hack This Site

Ebonyks

For all you wannabe hax0rs out there.

Have a go at this...

http://www.hulla-balloo.com/hack/

jammy_dodger

i gave up after level 3. not a bad idea tho.

Ebonyks

Yeah thought it was a good laugh, spent all this mornin at it.

Now totally stumped by level 8.

Hint for Lvl3 : File extensions are your friend

jammy_dodger

Originally posted by Ebonyks
Hint for Lvl3 : File extensions are your friend

And all this time, i thought they were hurting me

Ebonyks

Very funny :rolleyes:

But...sorry...I try to keep my inner nerd at bay

castie

im a newb couldnt even get past level 1

Chowley

Ya know that feeling, wtf are you supposed to do?

Mac daddy

What is the password

Oriel

Which password? Each level has it's own password.

damnyanks

First level is insanitypepper or something like that. Click view source.

b3t4

Best website and game yet.

A.

Chowley

I feel like a complete tit now, cant believe I didnt have a look at the source.
Thanks Damnyanks.

Divine

oh man i cannot get the password for level three i just dont know what to do...any hints?

Oriel

Look guys, there are people trying to do the thing, how about not posting hints here please?

Please use PM to post the hints or answers?...

Cheers.

jimhenson

Anyone got any hints for level 10,
can't get past it

Level 10 Question


Network Security Sam has decided to hardcode the password into the script. He also started to use cookies to detect if the user is authorized to advance to the next level. When you enter the correct password, it sets you to authorized, and if you enter an incorrect password, it sets you to unauthorized

Chowley

If anyone has a hint for Level 3 pm me.
Maybe I should just give it up.

Divine

yeah man level three for me aswell please, i know its something to do with the form action but what is it HELP!!!

Chowley

Its probably extremely obvious being only level3 which is what is making it difficult

Divine

i think this is right but it wont send it to my email address.....by the way i got this off the hint board thing

<center>
<form action="http://www.hulla-balloo.com/hack/level4/level4.php&quot; method="post">
<input type="hidden" name="sleekfx@hotmail.com" value="http://www.hulla-balloo.com/hack/level4/level4.php"&gt;
<input type="submit" value="Send password to Sam">
</form>
</center>

jimhenson

Originally posted by Chowley
If anyone has a hint for Level 3 pm me.
Maybe I should just give it up.

http://www.hulla-balloo.com/hack/level4/password.txt
Dont make the request for level3/password.txt that took me a while to figure out

Mixie

Level 3 Spoiler

He uploaded the unencrypted password file to get to level 4 to hulla-balloo.com/hack/level4/password.txt

Chowley

how did you figure it out? Jim, I should have said

jimhenson

The clue is given in the error message from the previous level, we know that the script accesses password.txt for the password

Warning: Unable to access password.txt in /home/sites/site18/web/hack/level3/index.php on
line 8
Warning: fopen("password.txt", "r") - No such file or directory in
/home/sites/site18/web/hack/level3/index.php on line 8
Level 3
This time Network Security Sam remembered to upload the password file, but there were
deeper problems then that.password.txt

Divine

hey i am putting this in for my action to get me onto level 5 but it dont seem to be working any nideas why?

<center>
<form action="http://www.hulla-balloo.com/hack/level4/level4.php&quot; method="post">
<input type="hidden" name="sleekfx@hotmail.com" value="http://www.hulla-balloo.com/hack/level4/level4.php"&gt;
<input type="submit" value="Send password to Sam">
</form>
</center>

Mixie

Originally posted by jimhenson
Anyone got any hints for level 10,
can't get past it

Level 10 Question


Network Security Sam has decided to hardcode the password into the script. He also started to use cookies to detect if the user is authorized to advance to the next level. When you enter the correct password, it sets you to authorized, and if you enter an incorrect password, it sets you to unauthorized

Levels 10 and 11 spoilers

Try to acess Level 11 from the navbar on the left. It will ask for a password. Then put the following into your browsers address bar and press return:

javascript:void(document.cookie = "level11_authorized=yes; path=/hack/level11/; host=www.hulla-balloo.com;")

The same code with slight modification will get you into level 12:

javascript:void(document.cookie = "level12_authorized=yes; path=/hack/level12/; host=www.hulla-balloo.com;")

edit: there should be no space between "java" and "script", for some reason boards.ie inserted them

Divine

any at all?

Mixie

Originally posted by Divine
hey i am putting this in for my action to get me onto level 5 but it dont seem to be working any nideas why?

<center>
<form action="http://www.hulla-balloo.com/hack/level4/level4.php&quot; method="post">
<input type="hidden" name="sleekfx@hotmail.com" value="http://www.hulla-balloo.com/hack/level4/level4.php"&gt;
<input type="submit" value="Send password to Sam">
</form>
</center>

You don't need to rewrite the page on this level, just pass your email address instead of the owners. Do this by:

hulla-balloo.com/hack/level4/level4.php?to=ME@MY.COM

If you must edit their page, your code should read:

<center>
<form action="http://www.hulla-balloo.com/hack/level4/level4.php&quot; method="post">
<input type="hidden" name="to" value="ME@MY.COM">
<input type="submit" value="Send password to Sam">
</form>
</center>

Mixie

There's another similar game available here.

Serbian

Hmm ... I'm stuck on level 5. I have an idea of what I am supposed to do, but I can't seem to get around the invalid referrer. Put what I have done so far in a spoiler so I don't ruin it for people!

I was on the index.php for level 5 and I tried changing that to level5.php?to=my@email.address. Still got invalid referrer...

Divine

hey serbian take a look at my code above and tell me what is wrong with it will ya pleeease!

Mixie

Originally posted by Serbian
Hmm ... I'm stuck on level 5. I have an idea of what I am supposed to do, but I can't seem to get around the invalid referrer. Put what I have done so far in a spoiler so I don't ruin it for people!

I was on the index.php for level 5 and I tried changing that to level5.php?to=my@email.address. Still got invalid referrer...

It's easy if you have a *nix box with CURL, just type:

curl --referer http://www.hulla-balloo.com/hack/level5/index.php -d to=ME@MY.COM http://www,hulla-balloo.com/hack/level5/level5.php

If you're not on unix / dont have CURL installed I imagine you'd have to telnet to the webserver, and talk HTTP to it. There should be guides for this on the net, good luck!

Serbian

Just copy and paste the following url into your browser:

http://www.hulla-balloo.com/hack/level4/level4.php?to=your@email.here - Don't forget to put your email in instead!!

Mixie

Originally posted by Divine
hey serbian take a look at my code above and tell me what is wrong with it will ya pleeease!

I posted a correction a post or two back Divine.

Divine

aw man i looked at the link you put up but it doesnt seem to tell me what is wrong with my code :-(

Serbian

Originally posted by Mixie

It's easy if you have a *nix box with CURL, just type:

curl --referer http://www.hulla-balloo.com/hack/level5/index.php -d to=ME@MY.COM http://www,hulla-balloo.com/hack/level5/level5.php

If you're not on unix / dont have CURL installed I imagine you'd have to telnet to the webserver, and talk HTTP to it. There should be guides for this on the net, good luck!

This is far too messy for me to be bothered with. I'm on Windows and have no access to UNIX. It's goodnight from me

Serbian

Okay, never mind, I managed to do it...

Mixie

Originally posted by Divine
aw man i looked at the link you put up but it doesnt seem to tell me what is wrong with my code :-(

There's a corrected version of your code there too...

padraigmyers

To the guy stuck on level 8, a clue is that its a SSI related hack. Try to run commands in the box where you enter you name.

Here a bit of a stronger clue,

put this in the name box<!--# exec cmd="pwd"-->

Here is the command you need if you still cant get it:

put this in the name box<!--#exec cmd="ls ../"-->, then go the the url of the txt file it returns the name of

Divine

ok i just realised how to work thse spoiler things there, thanks for the help!!!