HBH Javascript 2: Immediate Redirection
Since Javascript is implemented client-side, the first thing to do when hacking Javascript is to check the source code. Unfortunately, Hellbound Hackers’ second Javascript challenge contains code that redirects you immedieately when the page loads. In order to view the source code, you must somehow make the browser ignore this redirection. There are several ways. I assume that you are using Firefox:
- Disable Javascript — Edit -> Preferences -> Content, remove the tick in the Enable Javascript box.
- NoScript Add-On — Download the Firefox add-on NoScript, which enables selective enabling/disabling of Javascript in an easily accessible menu.
- wget — or any other application that can fetch remote websites. Functions for this exist in practically every programming language. With wget, you can just run
wget http://hellboundhackers.org/challenges/js/js2/index.phpand download a copy of the file, which you can read in any text editor.
When you have acquired the source code, you can find this code:
Except for the advertisement, this is the only Javascript and so must be the level 2 code. Load at the level2script.js file (in the same directory), and you will find the password easily.
var password, i; password=prompt("Please enter password!",""); if (password=="level2done") { location="huh.php" i=4; } else { alert("Wrong password, you'll go back to the index") location="index.php" }
My password was level2done. To enter the password, you must re-enable Javascript and reload the challenge page.auto loan eloanreview eloanbad england loan creditequity loans home insurancecalculation equity loanequity loan land onloans release home us equityloan payments estimate Map

Actually, you could just hit “stop” between the cancel and the redirect.
Comment by Istand1337 — April 18, 2007 @ 3:27 pm