HackThisSite-PenTesting-Basic-Part1

Please visit "Hack This Site" for further information.

The "Hack This Site" helps improve your penetration testing. The requirements include: HTML, common sense, email address, and JavaScript.

Basic - Level 1

Scenario 1:

This level is what we call "The Idiot Test", if you can't complete it, don't give up on learning all you can, but, don't go begging to someone else for the answer, thats one way to get you hated/made fun of. Enter the password and you can continue.

Solutions:

• Right-click anywhere on the web page, choose view page source.
• Scroll down until we find the word password or Ctrl + f and type the word password.

• Copy the password and paste it back on the password button and click submit.

Recommendation:

• Passwords should never be stored in plaintext in the source code. We can store it as a hashed value in a separate file or kept in an encrypted file. Hashing is more secure.

Basic - Level 2

Scenario 2:

Network Security Sam set up a password protection script. He made it load the real password from an unencrypted text file and compare it to the password the user enters. However, he neglected to upload the password file...

Solutions:

• Leave the password button blank and click submit.

Recommendation:

• Always test the application by submitting an empty blank password field.

Basic - Level 3

Scenario 3:

This time Network Security Sam remembered to upload the password file, but there were deeper problems than that.

Solutions:

• Right-click anywhere on the web page, choose view page source.
• On the hidden form, the value is password.php. So, please visit https://www.hackthissite.org/missions/basic/3/password.php.

• The password will appear.

• Copy and paste it on the password button and click submit.

Recommendations:

• Map out the directory structure of a web application before deploying it.

Basic - Level 4

Scenario 4:

This time Sam hardcoded the password into the script. However, the password is long and complex, and Sam is often forgetful. So he wrote a script that would email his password to him automatically in case he forgot. Here is the script:

Solutions:

• Right-click anywhere on the web page, choose view page source.
• On the type: hidden input, the value should be changed from sam@hackthissite.org to whatever email address corresponds to your account.

• Click send password to Sam. Please check the email address you put it down before.

• Copy and paste the password on the password button. Submit the password.

Recommendations:

• Sensitive information should not be included in the code if it is carried out on the client-side.
• Protect the sensitive information from being accessed by unauthorized personnels.

Basic - Level 5

Scenario 5:

Sam has gotten wise to all the people who wrote their own forms to get the password. Rather than actually learn the password, he decided to make his email program a little more secure.

Solutions:

• Right-click anywhere on the web page, choose view page source.
• On the type: hidden input, the value should be changed from sam@hackthissite.org to whatever email address corresponds to your account.

• Click send password to Sam. Please check the email address you put it down before.

• Copy and paste the password on the password button. Submit the password.

Recommendations:

• Sensitive information should not be included in the code if it is carried out on the client-side.
• Protect the sensitive information from being accessed by unauthorized personnels.

Conclusion

• Part 1 consists of HTML knowledge and common sense.