Playing With Technology - Break Bob's Account!

Folks,

In this edition of Playing With Technology, we have yet another simple challenge. Go ahead and enjoy it!

Scenario

Bob is a famous underworld hacker. His systems are known to be of proven security. He has recently launched a public website to which only very few of his friends have access. He has an admin account where he manages all the user accounts. Your goal is to login into the admin account and find the secret key! Bob generally is too confident about is system's secureness and hence he chooses only passwords of length 4. Also, he enforces an hourly limit of 30 hits to his website. As with the previous hack, clues and hints can lie anywhere and everywhere!

Bob's Website: http://foamsnet.com/pwt/bob_account/
Username: admin
Password Length: 4
Hourly Limit: 30 requests per hour!

Once you find the key, Post it as a comment in this post. I will approve all the comments once i reveal the answer and will aggregate all the correct responses along with the answer.

-Vignesh

PWT Solution - Reach Alice's Website

Hey guys,

Thanks for the overwhelming response for the first PWT post. Here is the solution and explanation for "Reach Alice's Website" hack.

You can view the question here.

To give away the solution in a briefly, it is about "HTTP Referer field in the request". HTTP requests can have a field known as the "Referer" which will contain the URL of the point of origin of that particular request. By looking at the Referer, the current page can find out where that particular request came from. Since it is easily forgeable (like in this hack), referers are generally used only for statistical purposes and none of the application level logic will rely on this field.

So yeah, the solution is, just send a HTTP request with the "Referer" set as "http://www.fakehackersworld.com" and you will get the key.

Here is a sample request without the Referer field set:


Here is a sample request with the Referer field set:


List of persons who completed this task

Please view their original comments to see how they did it.

• Varunkumar Nagarajan


• Viswabharathi


• Raghav


• Azhagu Selvan SP

Congrats to all of you !

The good response that i have got for this post will definitely keep me going about PWT! Thanks guys!

-Vignesh

Playing with Technology (PWT) - Reach Alice's Website !

Hey folks,

This is my first series called "Playing with Technology (PWT)". I will post an interesting real time question related to some technology for you to play around with. It will involve anything and everything i am familiar with. You may have to write scripts, perform hacks, etc. There are no rewards involved. It is just to share the minimal knowledge i possess in the form of an interactive series.

PWT will kick off today with a very simple real time hack that i call as "Reach Alice's Website". Go ahead and enjoy the hack.

Scenario

Alice (yes, our same good old friend Alice) owns a website. Recently, her website was acquired by Hackers World Inc. (http://www.fakehackersworld.com). The CEO of Hackers World considers this acquisition as a very confidential one and decides that all traffic to Alice website should only come through Hackers World website. But the sad part is that, Hackers World website is accessible only to the employees of Hackers World. Your goal, being a hacker, is to somehow reach Alice's website through Hackers World website and acquire the secret key from there!

Alice's Website: http://foamsnet.com/pwt/visit_alice_site
Hackers World Website: http://www.fakehackersworld.com

Remember clues can be lying/hiding in anywhere!

Once you find the key, Post it as a comment in this post. I will approve all the comments once i reveal the answer and will aggregate all the correct responses along with the answer.

Update: The solution has been posted here

-Vignesh