hacker.org

Jackpot, after trying and trying, I got it , it needs just the right number of '
Thank you very much!

gfoot wrote:As the challenge description says, you have to log in as 'adum' in order to see his secrets.

I logged in as adum (and as someone else) and still get the no secrets treatment. I even got it to work with the user name field having just the word adum in it so that it will show properly on the next page.

I'm actually surprised this wasn't enough, not because it was hard but because I think I have done what I was required to do. What am I missing?

bspus wrote:

gfoot wrote:As the challenge description says, you have to log in as 'adum' in order to see his secrets.

I logged in as adum (and as someone else) and still get the no secrets treatment. I even got it to work with the user name field having just the word adum in it so that it will show properly on the next page.

I'm actually surprised this wasn't enough, not because it was hard but because I think I have done what I was required to do. What am I missing?

I think the answer to this challenge is the password, not positive though, I solved it awhile ago.

DaymItzJack wrote:I think the answer to this challenge is the password, not positive though, I solved it awhile ago.

Even if I got the password, I would expect to log in and see the same "you have no secrets" message.
Considering that the challenge tells you not to try to "guess the password" as well as the fact that it asks you to break into his account and discover his "secret", it would be very misleading.

bspus wrote:

DaymItzJack wrote:I think the answer to this challenge is the password, not positive though, I solved it awhile ago.

Even if I got the password, I would expect to log in and see the same "you have no secrets" message.
Considering that the challenge tells you not to try to "guess the password" as well as the fact that it asks you to break into his account and discover his "secret", it would be very misleading.

I managed to log into adums account and the secret was right in front of me. I don't know exactly what you're doing but there aren't any tricks or anything.

I got in too by trying something slightly different. The thing is, it should have worked with my first method.
I believe the reason is that this is not a real vulnerability but just an exercise. The "exploit" is expected so it's all just make believe.
I 'll make a post in the solved section at some point to discuss it further.

edit: nevermind. My other method works now too. I wonder if something is changed

Aparently i must be stupid about Injections.. I can't get it to work.. and it's pissing me off.. Any who can help a nub?

I finally made it.. QUite easy now that i see how it's done

This is a great challenge! Once you figure it out it makes complete sense!

Hello! I got 500 Internal Server Error when visiting http://www.adum.com/secureroom/
Is this challenge still running?

You can try to send a mail to: adum (at) adum (dot) com