Guru's Blog

Download nhạc từ các trang nhạc lớn của Việt Nam

« hellboundhackers basic web challenges 17... | Trang chủ | All hellboundhackers Application Mission... »

19 Tháng Sáu 2007

@ 03:02

All hellboundhackers JavaScript challenges solution

(Tác giả:Phạm Đức Hải)

All hellboundhackers JavaScript challenges solution

lv1:
<!--
function pasuser(form) {
if (form.id.value=="partyhard2") {
if (form.pass.value=="lifeisshort1") {
location="index.php?user=partyhard2&pass=lifeissho

rt1"
    }
    else {
      alert("Invalid Password")
    }
}
else {
    alert("Invalid UserID")
}
}
//-->

lv2:

http://www.hellboundhackers.org/challenges/js/js2/level2script.js


lv3:

<script>
var U7=window,W8=document;
var a1="%3Cscript%20language%3D%22JavaScript1.1%22%3E%0D%0A%3C%21--%0D%0Afunction%20right%28e%29%20%7B%0D%0A%20%20if%20%28navigator.appName%20%3D%3D%20%27Netscape%27%20%26%26%20%28e.which%20%3D%3D%203%20%7C%7C%20e.which%20%3D%3D%202%29%29%0D%0A%20%20%20%20return%20false%3B%0D%0A%20%20else%20if%20%28navigator.appName%20%3D%3D%20%27Microsoft%20Internet%20Explorer%27%20%26%26%20%28event.button%20%3D%3D%202%20%7C%7C%20event.button%20%3D%3D%203%29%29%20%7B%0D%0A%20%20%20%20alert%28%22Rigth-mouse%20click%20isn%27t%20allowed%21%22%29%3B%0D%0A%20%20%20%20return%20false%3B%0D%0A%20%20%7D%0D%0A%20%20return%20true%3B%0D%0A%7D%0D%0Adocument.onmousedown%3Dright%3B%0D%0Aif%20%28document.layers%29%20window.captureEvents%28Event.MOUSEDOWN%29%3B%0D%0Awindow.onmousedown%3Dright%3B%0D%0A//--%3E%0D%0A%3C/script%3E%0D%0A%0D%0A%3Cscript%20language%3D%22javascript%22%3E%0D%0A%3C%21--%0D%0Afunction%20pasuser%28form%29%20%7B%0D%0Avar%20text2%3D%27lolage%27%0D%0Avar%20text4%3D%27hahaomgz%27%0D%0A%20%20if%20%28form.text1.value%3D%3Dtext2%29%20%7B%20%0D%0A%20%20%20%20if%20%28form.text3.value%3D%3Dtext4%29%20%7B%20%20%20%20%20%20%20%20%20%20%20%20%20%20%0D%0A%20%20%20%20%20%20location%3D%22index.php%3Ftext1%3Dlol%26text3%3Dhaha%22%20%0D%0A%20%20%20%20%7D%0D%0A%20%20%20%20else%20%7B%0D%0A%20%20%20%20%20%20alert%28%22Invalid%20Password%22%29%0D%0A%20%20%20%20%7D%0D%0A%20%20%7D%0D%0A%20%20else%20%7B%0D%0A%20%20%20%20alert%28%22Invalid%20UserID%22%29%0D%0A%20%20%7D%0D%0A%7D%0D%0A//--%3E%0D%0A%3C/script%3E%0D%0A%3Ccenter%3E%0D%0A%20%20%3Ctable%20cellpadding%3D%224%22%20border%3D%220%22%3E%0D%0A%20%20%20%20%3Ctr%3E%0D%0A%20%20%20%20%20%20%3Ctd%20align%3D%22center%22%20height%3D%2224%22%20width%3D%2284%22%3EUser%20ID%3A%3C/td%3E%0D%0A%20%20%20%20%20%20%3Ctd%20align%3D%22center%22%20height%3D%2224%22%20width%3D%22170%22%3E%3Cform%20name%3D%22login%22%3E%3Cinput%20name%3D%22text1%22%20type%3D%22text%22%3E%3C/td%3E%0D%0A%20%20%20%20%3C/tr%3E%0D%0A%20%20%20%20%3Ctr%3E%0D%0A%20%20%20%20%20%20%3Ctd%20align%3D%22center%22%20height%3D%2224%22%20width%3D%2284%22%3EPassword%3A%3C/td%3E%0D%0A%20%20%20%20%20%20%3Ctd%20align%3D%22center%22%20height%3D%2224%22%20width%3D%22170%22%3E%3Cinput%20name%3D%22text3%22%20type%3D%22password%22%3E%3C/td%3E%0D%0A%20%20%20%20%3C/tr%3E%0D%0A%20%20%20%20%3Ctr%3E%0D%0A%20%20%20%20%20%20%3Ctd%20align%3D%22center%22%20height%3D%221%22%20width%3D%2284%22%3E%3Cinput%20type%3D%22button%22%20value%3D%22Login%22%20onClick%3D%22pasuser%28this.form%29%22%3E%3C/td%3E%0D%0A%20%20%20%20%20%20%3Ctd%3E%3C/td%3E%0D%0A%20%20%20%20%3C/tr%3E%0D%0A%20%20%3C/table%3E%0D%0A%3C/center%3E";
function V0(){var V0;V0=unescape(a1);W8.write(V0);}V0();
</script>
Using html decode : http://scriptasylum.com/tutorials/encdec/encode-decode.html

<script>
var U7=window,W8=document;
var a1="<script language="JavaScript1.1">

</script>

<script language="javascript">

</script>
<center>
<table cellpadding="4" border="0">
    <tr>
      <td align="center" height="24" width="84">User ID:</td>
      <td align="center" height="24" width="170"><form name="login"><input name="text1" type="text"></td>
    </tr>
    <tr>
      <td align="center" height="24" width="84">Password:</td>
      <td align="center" height="24" width="170"><input name="text3" type="password"></td>
    </tr>
    <tr>
      <td align="center" height="1" width="84"><input type="button" value="Login" onClick="pasuser(this.form)"></td>
      <td></td>
    </tr>
</table>
</center>";
function V0(){var V0;V0=unescape(a1);W8.write(V0);}V0();
</script>
--->
var text2='lolage'
var text4='hahaomgz'
--->http://www.hellboundhackers.org/challenges/js/js3/index.php?text1=lol&text3=haha
Change to : http://www.hellboundhackers.org/challenges/js/js3/index.php?text1=lolage&text3=hahaomgz -->ok

lv4:
javascript:alert(document.cookie);document.write (document.cookie);
Using XSS:
http://www.hellboundhackers.org/challenges/js/js4/index.php?submit=%3Cscript%3Ealert(document.cookie)%3C/script%3E

lv 5:
<script language="JavaScript" src="level5.js"></script>
http://www.hellboundhackers.org/challenges/js/js5/level5.js
a = prompt("Please enter password!","");
date = new Date();
year = date.getYear();
    b = year+12;
if(a == b){
    alert("Good job! You got it!");
    window.location.href=year+".php";
}
else
{
    alert("Try it again!");

}

---->Create a html file :
<html>
<head>
<title>Owned</title>
</head>
<script language="javascript">
a = prompt("Please enter password!","");
date = new Date();
year = date.getYear();
    b = year+12;
alert(b);
if(a == b){
    alert("Good job! You got it!");
    window.location.href=year+".php";
}
else
{
    alert("Try it again!");

}

</script>
</html>
---------> alert(b); 118

lv6:
<script language="Javascript">
function checkPass(){
Location = document.form.password.value
Location = "js6-" + "window.open" + ".php"
document.write("Pass= " + Location);
if (document.form.password.value == Location ) {
    alert("Good Job!")
    window.open(Location)
    }
else{
    alert("Try Again!")
    }
}
</script>

--->pass: js6-window.open.php

lv7 :
Using Flashget download file :
http://www.hellboundhackers.org/challenges/js/js7/index.php
<script language="JavaScript">

function password () {

    var s1, a2, v3, e4, input;
    s1=window.document.bgColor;
    a2=window.document.linkColor;
    v3=s1.substring (6,9)+a2.substring (2,8);
    e4=v3.toUpperCase ();
input=prompt("Password:","");
if (input!=v3 && input!=e4) {
      alert("Wrong!");
      window.location.href="../index.php";
    }
else {
      window.location.href=v3+".php";
    }
}
</script>
</head>
<body bgcolor="#D0D0D0" text="#FF9900" onLoad="password()" link="#FF9900">

--->pass :0f9900

lv8:
<script>document.cookie="secret=90 dd 3b 21 5f 23 9a 63 3f a6 ae 3c 31 64 3f 60 2e ea 3f 72 51 cf fd f0 fe"</script>
Solve : hex->decial->ACSII
90 dd 3b 21 5f 23 9a 63 3f a6 ae 3c 31 64 3f 60 2e ea 3f 72 51 cf fd f0 fe144 221 59 33 95 35 154 99 63 166 174 60 49 100 63 96 46 234 63 114 81 207 253 240 254
144 221 59 33 95 35 154 99 63 166 174 60 49 100 63 96 46 234 63 114 81 207 253 240 254
A-AZ: 65-90
a-Z : 97-122
max : 254-122 = 132
---> 63 : a,e,i,o,u
63 : a,--> d=97-63=36 : ª
63 : e --> d=101-63 = 38 : ¶
63 : i --> d=105-63 = 42 : º
63 : o --> d=111-63 = 48 : À
63 : u

lv9:
<script>
var c = 34200;
var p = "%68%6F%77%73%6C%69%66%65%3F%65%61%73%79%2E%00";
var a;
fc();
function fc()
{
if(c>0)
{
   document.getElementById("say").innerHTML = "<b><big>Please wait " + c + ' seconds.</big></b>';
   c = c - 1;
   setTimeout("fc()", 1000)
} else {
   a = unescape("%33");
   document.getElementById("say").innerHTML = "Your password is: " + unescape(p-a) + unescape("%3C%66%6F%72%6D%20%61%63%74%69%6F%6E%3D%27%69%6E%64%65%78%2E%70%68%70%27%20%6D%65%74%68%6F%64%3D%27%50%4F%53%54%27%3E%0D%0A%45%6E%74%65%72%20%50%61%73%73%77%6F%72%64%3A%20%3C%69%6E%70%75%74%20%74%79%70%65%3D%27%74%65%78%74%27%20%6E%61%6D%65%3D%27%70%61%73%73%27%20%73%74%79%6C%65%3D%27%74%65%78%74%62%6F%78%27%3E%3C%62%72%3E%0D%0A%3C%69%6E%70%75%74%20%74%79%70%65%3D%27%73%75%62%6D%69%74%27%20%6E%61%6D%65%3D%27%73%75%62%6D%69%74%27%20%76%61%6C%75%65%3D%27%43%68%65%63%6B%20%79%6F%75%20%61%6E%73%77%65%72%27%20%73%74%79%6C%65%3D%27%62%75%74%74%6F%6E%27%3E%0D%0A%3C%2F%66%6F%72%6D%3E%00");
}
}
</script>

decode :
<script>
var c = 34200;
var p = "howslife?easy.";
var a;
fc();
function fc()
{
if(c>0)
{
   document.getElementById("say").innerHTML = "<b><big>Please wait " + c + ' seconds.</big></b>';
   c = c - 1;
   setTimeout("fc()", 1000)
} else {
   a = unescape("3");
   document.getElementById("say").innerHTML = "Your password is: " + unescape(p-a) + unescape("<form action='index.php' method='POST'>
Enter Password: <input type='text' name='pass' style='textbox'><br>
<input type='submit' name='submit' value='Check you answer' style='button'>
</form>;
}
}
</script>
----: javascript:c=1;Back-->ok

lv10:
<script>
   //By system_meltdown
   function checkpass()
   {
   pass=document.password.pass.value;
   rawr=unescape('%61%68%6f%79');
   string="llama llama duck!";
   a=string.charCodeAt(1);
   b=string.charCodeAt(7);
   c=string.charCodeAt(4);
   schloob

60*50/3*a)-(b*c))/2/5+b;
   asdf=rawr+"_"+schloob;
   if(pass==asdf)
   {
      alert('Wahoo you got it!');
   }
   else
   {
      alert('Awww shame!');

   }
   }
</script>
rawr=unescape('%61%68%6f%79');decode : rawr=unescape('ahoy');
schloob=9860.4
asdf=ahoy_9860.4

lv11:
<script>
//By system_meltdown
var s = "Llama llama chicken duck, schloob mcfroob, moo asdf qwerty zxcv. Rawr llama kinasd, [insert random crap here]It's hammer on the keyboard time: sfsdfoashdfy78sdfysdfs67dftsdf 6tsdf76as tfa. Well I'm bored, so if you're still reading this I advise you to stop because you are wasting your time....dumbarse

";
var asd = s.charCodeAt(14);
var fdsa = s.charCodeAt(42);
var sadfasf = s.charCodeAt(4);
var moo = s.charCodeAt(43);
var teeep = s.charCodeAt(32);
var asdf = asd+fdsa+sadfasf+moo+teeep;
function checkpass()
{
pass=document.password.pass.value;
if(pass==asdf)
{
alert('Well done dude!');
}
else
{
alert('You suck!');
}
}
</script>

--->javascript:alert(asdf); -->pass : 441

lv12:
<script>

function checkpass()
{
pass=document.password.pass.value;
z=2;
x=z*1.5;
v=z*2;
w=v*1.75;
y=v*1.25;
abc

(y*v*y*x+z)*x+w)*z+y)*v+w;

if(pass==abc)
{
alert('Congratz! You are good at Math');
}
else
{
alert('Sorry, try again when you learn more Math!');

}

}

</script>

---> pass: 7331

lv13:
<script>document.cookie='authorized=false'</script>
-->
http://www.hellboundhackers.org/challenges/js/js13/index.php?javascript:document.cookie='authorized=true'

lv14:
script>
a = screen.width;
if(a != 800)
{
alert('Sorry you do not have the right parameters!');
}else{
window.location='/challenges/js/js14/index.php?ans=0e110c5fbf226dffd25740ae56d4edb1'
}
http://www.hellboundhackers.org/challenges/js/js14/index.php?ans=0e110c5fbf226dffd25740ae56d4edb1

lv15:
   var a = password.charAt(9)=q
   var b = password.charAt(10)=u
   var c = password.charAt(4)=e
   var d = password.charAt(7)=r
   var e = password.charAt(1)=y
   var f = password.charAt(6)=""
   var g = password.charAt(3)=t
   var h = password.charAt(8)=e
   var i = password.charAt(0)=s
   var j = password.charAt(13)=t
   var k = password.charAt(6)=""
   var l = password.charAt(5)=m
   var m = password.charAt(11)=e
   var n = password.charAt(2)=s
   var o = password.charAt(12)=s
   var riddle = "query test mess";
-->pass : system request