413 visitors now

Newest members :

Chatbox

AlyB
17 June 2019 at 11:23

coconuthead yeah, I was eventually able to spawn a shell without it. The shell spawned in this one doesn’t seem to inherit it’s privileges from the program and so catting the password file doesn’t seem to work. Is there a problem with the challenge?
coconuthead
16 June 2019 at 21:22

AlyB, I don’t remember exactly, but I think you need to read the file in the context of the program you exploited. If you just ret2libc and spawned another shell proc I _think_ it changes the user group? And you need to be a certain group to read it
grainbames
16 June 2019 at 20:29

i cant open the start challenge on google chrome os!

>

rafraichir

Newsletter

Sponsored by

Follow us

HTTP Response Splitting

70 Points

Old vulnerability... but powerful !

Author

Arod, 7 November 2013

Level

Validations

570 Challengers 1%

Note

95 Votes

To reach this part of the site please login

1 Solution

Display solutions Submit a solution

Challenge Results

Pseudo	Challenge	Lang	date
constantinje	HTTP Response Splitting		16 June 2019 at 15:06
FL0RlAN	HTTP Response Splitting		15 June 2019 at 04:10
BadBoy17	HTTP Response Splitting		14 June 2019 at 22:22
SerieS	HTTP Response Splitting		14 June 2019 at 20:37
MystCaster	HTTP Response Splitting		14 June 2019 at 13:49
supernico5000	HTTP Response Splitting		13 June 2019 at 23:14
Ric0s	HTTP Response Splitting		10 June 2019 at 12:00
Flamecube64	HTTP Response Splitting		8 June 2019 at 18:41
andy_sliver	HTTP Response Splitting		7 June 2019 at 22:11
StackNinja	HTTP Response Splitting		7 June 2019 at 13:21

0
10
20
30
40
50
60
70
80
...

19 Challenges

Results	Challenge's Name	Validations	Number of points	Difficulty	Author	Note	Solution
	HTML - disabled buttons	29% 38483	5		Final		7
	Javascript - Authentication	42% 57133	5		g0uZ		8
	Javascript - Source	41% 55120	5		g0uZ		4
	Javascript - Authentication 2	37% 49373	10		na5sim		3
	Javascript - Obfuscation 1	36% 48184	10		Hel0ck		9
	Javascript - Obfuscation 2	31% 41525	10		Hel0ck		6
	Javascript - Native code	21% 28179	15		g0uZ		5
	Javascript - Obfuscation 3	17% 22841	30		Hel0ck		6
	XSS - Stored 1	10% 13228	30		g0uZ		9
	CSRF - 0 protection	6% 6964	35		sambecks		7
	Flash - Authentication	3% 2856	40		koma		1
	CSRF - token bypass	2% 2181	45		sambecks		7
	XSS - Reflected	1% 981	45		pickle		3
	Javascript - Obfuscation 4	3% 2928	50		aaSSfxxx		3
	XSS - Stored 2	3% 3429	50		g0uZ		5
	HTTP Response Splitting	1% 570	70		Arod		1
	Javascript - Obfuscation 5	1% 353	70		Hel0ck		3
	XSS - Stored - filter bypass	1% 511	80		Arod, sambecks		4
	XSS - DOM Based	1% 229	85		vic		4