Suninatas Game 02

Posted on Edited on In Views: Disqus:

challenges

Game 02

Analysis

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
<script>
  function chk_form() {
    var id = document.web02.id.value;
    var pw = document.web02.pw.value;
    if (id == pw) {
      alert("You can't join! Try again");
      document.web02.id.focus();
      document.web02.id.value = "";
      document.web02.pw.value = "";
    } else {
      document.web02.submit();
    }
  }
</script>
<!-- Hint : Join / id = pw -->
<!-- M@de by 2theT0P -->

The script prevents the form from being submitted if the id is equal to the pw. However, the hint explicitly states that for the Join challenge, we need id = pw.

Bypass

Intercept the request with a proxy (like Burp Suite or Zaproxy) or use the browser’s Network tab to replay a modified request.

id=admin&pw=admin