[hackthissite]Realistic 13 tutorial

btw for this mission u'll need a brute forcer i recomend cain & abel its very usefull in many other ways too. also u'll need a hash calulator besides cain cus that only works in caps. i recomend HashCalc (hu wudda guessed?) but anyway onto the mission:

From: Fr0zenB1t

Message: Hey, Josh Haze (a.k.a. Fr0zenB1t) here, I REALLY need some help. As you know, I'm in with the AOE (Anarchists of Elbonia). Our mission is to thwart the upcoming elections, and atleast attempt to delay them for the time being. The way we've decided would work best is if one of the main competitor's site is taken down. Even if it is down for a small amount of time, things wont go smoothly for him, and things will be delayed...

BTW: Elbonia Election Site

okay the mission starts off with this dude hu wants u to hack his opposition the Elbonian National Republican Party's website and bring it down just until the upcoming elections. this mission had me stumped for quite a while so thats why i decided to write this article. so we search around the site looking for anythin interesting. but humm... there's not really alot that catches our eye.. we need to look deeper. but what's this..? in the speeches page.. hmm

"The following speeches have been given already:

This speech is still being edited, as it had many errors because of our ex-typist"

whenever we try and view the speech.. lets look in the source at the form.. it has a speeches*.php page.. so lets try and view this.. woahaa now what do we have here..? its an error page.. hmmm this may all look like garbage but look thru it carefully.. something may come in useful.. maybe look for.. a hash..? it is blatantly obvious here in this page..

so what next? we may have found a hash here and it could proove useful. so lets look around the site again and try and find another "error" page...
i'm going to let u find this one. so now we have found this page.. there seems to be nothing interesting on this really.
but is there... look thru this 1 carefully too and u shal find a certain type of a hash encryption.. md*... hmmm..

now we'll get back to this in a min. i recomend searching for an admin page.. so lets try maybe "/admin" wow hey we've found one! but sorry to disapoint u but this has been put there purposely to mislead you. back to the error pages. u'll see that the certain encryption type again.. now maybe we shud try brute forcing that hash we found in the 1st error page with this encryption type.. and what do we get? hmmm interesting..
it looks to have the same value as that fake admin page.. so lets try adding the hash onto the end of the URl.. huh! wow we found the correct admin page! woooo! so this is most interesting. so lets apply this knowledge that we have learnt.. the hash of a certain place can be a directory.. hmm..

moving on.. look at the encryption type: md*. next to that we see (Sp*****) and before that

GET sp*****/p*******s..
so maybe just maybe the md* of Sp***** could be another directory? look at /sp*****/p*******s and it will come up with subdir.. so maybe if we find the hash of Sp***** and add that to the end of the URL and p*******s on the end again it might give us something.. tehe i'll leave the rest up to you!

btw if i have given too much away here which i fear i may have done please send me a PM thru hack this site not as a post.

hope this leads u in the right direction
and excuse me if this article is a little rough around the edges as its my first arcticle!

paranoiahax xxxxxxxxxxxxxxxxxxxxxxxxx


http://www.hackthissite.org/articles/read/464