3 ms·
Well, I got the admin panel to show a completely blank page, instead of an Invalid Login message, so that's progress.
by Gollapalli 4y ago
Well, I got the admin panel to show a completely blank page, instead of an Invalid Login message, so that's progress.
- hayst4ck 4y agoYou got it to 500, which can be seen via the network dev tools console. (A place you can also right click and "Copy as cURL", to iterate on the command line faster) ^^ A 500 is almost always a good sign when it comes to hacking. Hacking is the art of finding the difference between intended behavior and actual behavior. That is pretty much the definition of a 500.
- Gollapalli 4y agoWell I got the admin menu to show up. Still lost the chess game though (my chess skills need work).
- hayst4ck 4y agoA little bit of python and some stockfish could probably improve your play dramatically! https://github.com/official-stockfish/Stockfish https://github.com/official-stockfish/Stockfish
- Gollapalli 4y agoLol I thought about it. Thanks for the reply.
- m4jor 4y agoAny tips? I tried brute forcing the login admin panel but no luck yet. What username should I use? I tried all the basic ones and cant get it to display anything besides "Invalid Login!".
- hayst4ck 4y agoIt sounds like you've tried [a-zA-Z]* usernames in an attempt to see if you could guess a username. It probably says "Invalid Login!" no matter what is guessed. What do you imagine the code that takes the logins eventually does? It seems likely that the username and password will end up in a query against a database to see if the user is valid and (theoretically) if the hash of the password matches the stored value. What kind of input could you try to see if that behavior is done securely? This is a good site to start learning about security: https://owasp.org/www-project-top-ten/ https://owasp.org/www-project-top-ten/ Injection will be the most immediately relevant.