No worries, I'm certainly not "getting" the riddle myself. I tried md5sum'ing the response body and base64 encoding it and replacing the cookie's csrf.token value with that, which didn't work (I did notice, however, that the server is accepting whatever you put in the cookie without re/over writing it). I tried POSTing and PUTing with data values like "csrf=valuefromcookie" and (this may seem stupid) "browser=seatgee…
Not so stupid. The error message is important.
face palm
What's more annoying is I did do it correctly the first time - I just misspelled it! :-/
I quite enjoyed this :-) Reminds me of an online game that I played through years ago which I'm having trouble digging references to now; hack your way through successive levels, starting with really trivial things like default passwords and working your way up through all the exploitation techniques through to the more interesting ones (buffer overflows, off by 1 errors etc). I was well hooked on the writings of Ale…
I wonder if you're thinking of Uplink? http://en.wikipedia.org/wiki/Uplink_(video_game) I was completely addicted to that game in college. The also apparently have a version on steam now.
Thanks for the link, had not seen Uplink before. It's not what I was trying to remember though. I'm basically talking about a website. On the first screen it has a username and a password box. The password check is hardcoded into the JS on the page and viewsource gives it to you. Completing it gets you to the next stage. The next stage has no such info, but the password is easily guessable. The one after can be beaten by a cookie modification, the one after that involves injecting some variables into a server-side script etc etc... At each stage it links you to articles which may be relevant tothe task at hand; It's like a step-by-step training to hacking websites, graded nicely in difficulty from the trivial up to some reasonably difficult techniques at the higher stages.
Not too shabby. Was pretty trivial to do with Safari's developer tools, actually. I submitted this as my resume: http://www.russellheimlich.com/blog/wp-content/uploads/2007/...
Ha, I submitted my 'CV' as a (trivially) encrypted PDF. If I have to hack their site to apply, they have to hack my CV to read my application :-)
I wonder if you're thinking of Uplink? http://en.wikipedia.org/wiki/Uplink_(video_game) I was completely addicted to that game in college. The also apparently have a version on steam now.
Thanks for the link, had not seen Uplink before. It's not what I was trying to remember though. I'm basically talking about a website. On the first screen it has a username and a password box. The password check is hardcoded into the JS on the page and viewsource gives it to you. Completing it gets you to the next stage. The next stage has no such info, but the password is easily guessable. The one after can be beate…
Answering my own question here, but curiosity got the better of me so I trawled through my mail archives and found the site. It was http://quiz.ngsec.com/ and it's unfortunately offline now. Shame.