vee1e/Cryptonite-Taskphase
1
0
Fork 0
mirror of https://github.com/vee1e/Cryptonite-Taskphase.git synced 2026-09-01 19:17:14 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix videos

Browse source
This commit is contained in:
Lakshit Verma 2023-11-03 03:08:11 +05:30 • committed by GitHub
parent ca56a622ca
commit d72bd0ae2f
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 7 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

9
Phase 2/03 Web Exploitation.md
View file

@ -24,7 +24,9 @@ We are given a website `http://saturn.picoctf.net:50920/`, which opens to a logi
We open our browser's network tab and enter meaningless data in the input fields. After that we open the request titled `secure.js` and go into its *Response* tab.
<video src="https://github.com/lucky-vers/Cryptonite-Taskphase/raw/main/Images/login_attempt.mp4" width=180/>
https://github.com/lucky-vers/Cryptonite-Taskphase/assets/51952975/e08177a5-6516-4291-98d0-47a89f523bd6
We find the following (very insecure!) JavaScript code that checks whether the username and password are that of the admin's or not
@ -44,5 +46,8 @@ function checkPassword(username, password)
Therefore, the username we need is `admin` and the password `strongPassword098765`. Using these details, we successfully log in and acquire the flag.
<video src="https://github.com/lucky-vers/Cryptonite-Taskphase/raw/main/Images/admin_login.mp4" width=180/>
https://github.com/lucky-vers/Cryptonite-Taskphase/assets/51952975/8b7d50f8-eb97-4801-b99e-16fe569cc6e0