What is it? @.@

Here is the place where I record some tactics about wargame, systems, and other security issues.

2012-11-15

Bright Shadows - JavaScript 5: "Easy script"

Description:

Hey just log in here!
          ____________________      
Username:|____________________| Check

Solution:
  1. View page source code and find the JavaScript code like below.

    <script type="text/javascript">
      function check() {
        pass     = unescape('%44%61%67%6F%62%65%72%74%20%44%75%63%6B');
        solution = pass.substr(0,8)+pass.substring(9,13)+pass.substring(8,9);
        passwd = document.formular.user.value;
        if (passwd == solution) {
          window.location.href=solution+".php";
        }
        else {
          alert("False!!!");
        }
      }
    </script>
    

  2. There are three variables has relationship with the password to help us to pass this challenge.
    1.pass = unescape('%44%61%67%6F%62%65%72%74%20%44%75%63%6B')
           = Dagobert Duck
    (Tool: http://www.tareeinternet.com/scripts/unescape.html)

    2.solution = pass.substr(0,8)+pass.substring(9,13)+pass.substring(8,9);
               = "Dagobert"+"Duck"+" "
    (Reference:
    [substr]
    https://developer.mozilla.org/en-US/docs/JavaScript/Reference/Global_Objects/String/substr
    [substring]
    https://developer.mozilla.org/en-US/docs/JavaScript/Reference/Global_Objects/String/substring
    )

    3.passwd = the value we input
  3. So, the final solution is "DagobertDuck ". (*There's a white space in the end.)

No comments:

Post a Comment