HTS Basic Web 4: Alter the Hidden Fields -- Timblog

HTS Basic Web 4: Alter the Hidden Fields

In the fourth basic web mission, Network Security Sam apparently hasn’t learnt anything from his prior mistake. In the third basic web mission, we extracted information from hidden form fields and thereby found out the name of a password file. The procedure is essentially the same in this mission. As usually, check the source code first. These snipets have been formated for easier reading:

As you can see, this level contains two forms. The upper one is the “Send password to Sam” button, and the lower one is the password field. You should already have noticed the highly suspicious hidden field in the upper form. Its purpose is obvious: it supplies the email address that the password will be emailed to. From merely knowing this address, you cannot achieve anything (except if you managed to hack the hulla-balloo.com server). Therefore, you should alter the field to contain your email address instead of Sam’s.

In order to enter your own information in to, the hidden field, you can create a local copy of the form. In your modified version, you can either change webmaster@hulla-balloo.com to your own email address, or change the type="hidden" to type="text". The prior changes the email address automatically, while the latter allows you to enter another address.

If you are pedantic and want your local version to validate, use the following code.

Remember to change the URL from local to absolute (http://hackthissite.org/missions/basic/4/level4.php instead of /missions/basic/4/level4.php). Save the file as e.g. hackthissite.htm, then open it in your web browser.article credit protection aarp abd psychology transfer credits century credits fox 20th accounts control credit receivable specialist day credit 30 fix duty active campaign months service credit absenteeism credit risk monitoring credit evaporation 1440 program Map

Maybe Related?

Posted July 19, 2006 in Guides » Hack This Site.

105 Comments »

[...] This is the fifth basic web mission, and Network Security Sam apparently “secured” his email script. After a quick look at the source code, we see that the code visible to us is exactly the same as in the last mission. However, if we try the same hack as in the fourth mission, writing a form of our own, we can see that Sam’s new script checks the referer, i.e. the page that you came from. If it is not equal to the page that you are supposed to come from, you get an error. [...]

Pingback by Timblog » HTS Basic Web 5: Javascript Injection — July 24, 2006 @ 11:58 pm

Hey. thanks for all of the great tips that you are giving. the make a lot of sense really. i tried the articles on the hack this iste website and most of them were not helpful.

Comment by CJ — September 26, 2006 @ 7:14 pm

CJ: Thanks. You’re very welcome.

Comment by Tim — September 26, 2006 @ 7:23 pm

i dont understand the last part! how can i modify the page…i cant change the email to mine…im using internet explorer.
How do i modify a source code? HELP!!!!
PS: im a noob hacker..

Comment by ultima_hacker — November 26, 2006 @ 8:47 pm

ultima_hacker: You’re absolutely right that you cannot edit the source code directly. However, you can download the page to your computer and edit the file in e.g. notepad. After you’ve done that, open the local file in your webbrowser. Also, as long as you’re trying without cheating, you’re certainly not a noob.

Comment by Tim — November 27, 2006 @ 12:07 am

When following your tips, I get the error message: Need to be Authed to use this page. Any ideas?

Comment by Tom — December 4, 2006 @ 1:47 am

Tom: Perhaps you aren’t logged in?

Comment by Tim — December 4, 2006 @ 6:38 am

well, i agree with the last comment… i’ve tried it and it happens the same thing. what i do is to: save the page, then edit the source code by changing the type=”hidden” to “text” and i save the changes to my computer. after that i open the saved page again and i put my e-mail address and click on “send password to sam” and then it’s when the message “Need to be Authed to use this page”. What have i done wrong?

Comment by penevasi — December 4, 2006 @ 6:35 pm

i have the same problem, it says ERROR: you need to be authed to use this page i dont know what to do either

Comment by svordan — December 15, 2006 @ 11:25 pm

actually i figured it out, i save it as an .html fiel instead of .htm and it worked

Comment by svordan — December 15, 2006 @ 11:29 pm

svordan: Thanks! Weird error, though. That will hopefully make it work for the rest, too.

Comment by Tim — December 16, 2006 @ 4:35 pm

Auth error, I got it, I saved the source with the .html extension, still getting the same error.

Comment by Nox — December 17, 2006 @ 7:16 pm

Since Tims solution isn’t working, I can help suggest an alternative.
In the URL Bar, simply enter

http://www.hackthissite.org/missions/basic/4/level4.php?to=“Youremail@domain.org”

and press enter, that’ll save you some hassle, while still sending to your email

Comment by Nox — December 17, 2006 @ 7:38 pm

Man I just used the last tip from Nox and I didn’t get the email.
It said : Password reminder successfully sent. but I don’t get the e-mail.

I sent it like 10 minutes ago, it’s not normal.

I even tried with two different e-mails.

Thanks.

Comment by Vincent — December 21, 2006 @ 8:50 pm

Vincent: You’re not supposed to get the email, I think. You are given the “mission successful” notice as soon as you send the password to your email address.

Comment by Tim — December 22, 2006 @ 12:02 am

I haven’t got the notice :-(.

Even though I typed http://www.hackthissite.org/missions/basic/4/level4.php?to=vincent_blouin@carte-mentale.com

Comment by Vincent — December 23, 2006 @ 11:40 pm

And I tried to access http://www.hackthissite.org/missions/basic/5 directly but it didn’t work !

By the way thks for minding Tim & Nox.

Comment by Vincent — December 23, 2006 @ 11:44 pm

Ok, now it works for me, I got a password and passed the level.

I had to use the same browsers on the internet to save the page and on my local machine whence the I used the modified html form. For example using Firefox on the internet and then opening the page on my local machine with Internet Explorer wouldn’t do it and vice-versa.

Also, I had to type “www” in the adress in the form, not just http://hackthissite...

And I still am not able to get the password using the ? caracter. It says the message is succesfully sent but do not show the password.

Finally the password is not sent to our e-mail box but simply shown on the level4.php page whence we do things right.

Ciao.

Comment by Vincent — December 25, 2006 @ 9:52 pm

How to save the page into your computer? Just right click on http://www.hackthissite.org/missions/basic/4/index.php?

Thansk for helping!

Comment by Jonathan — February 2, 2007 @ 9:41 am

Jonathan, pushing Ctrl+S usually works.

Comment by Tim — February 3, 2007 @ 7:56 am

Why saved as a “.htm” file?
Why not just as original,one “index.php” file?
However,i tried and it works,hoho
thank you give the solutions
ps:my english is poor… from china

Comment by marszhe — February 4, 2007 @ 3:20 pm

marszhe, the filename does not matter — use whatever you wish.

Comment by Tim — February 4, 2007 @ 6:21 pm

Umm when i try to open it in notepad it says the 3 source instead of 4 i tried the 4 source 8 times now! HELP ME!

Comment by Phoenix23 — February 8, 2007 @ 2:20 am

Phoenix23: Could you describe exactly what you are doing? Also, why do you think that it is the level 3-source?

Comment by Tim — February 8, 2007 @ 6:22 am

when you see the source, copy it instead if saving it, because some of the source will disappear, so, after that, you should be able to finish finding the password. Also i guess a index.php file would work, but doesnt it take less time to type .html or .htm????¿¿¿¿

Comment by ......... — February 25, 2007 @ 6:20 am

………: I doubt that something disappears — that’s probably due to human mistake. The file extension does not matter, though typing php takes marginally less time than typing htm since the P is used twice.

Comment by Tim — February 25, 2007 @ 9:17 am

i do not understand how to make the code absolute can somone explain it please i just started and for some reason i can do the other missons execpt 4 and 5

Comment by Dreux — April 17, 2007 @ 4:55 pm

Dreux: What do you mean with making the code “absolute”? Yo should download the page to your computer, and then edit it.

Comment by Tim — April 17, 2007 @ 7:59 pm

I mean i veiw the source then change what i need done. how do you download it and change it?

Comment by Dreux — April 18, 2007 @ 4:08 pm

okay i will try to explain i veiw source then find the thing i need changed, then i save it and exit it then i veiw the source again and it hasen’t changed as you mentioned here. “Remember to change the URL from local to absolute”

Comment by Dreux — April 18, 2007 @ 4:26 pm

Hey i am having the same problem as dreux i can not get it to save i veiw the source code change the address save it and it will not change can you help me please

Comment by Jon — May 7, 2007 @ 5:22 pm

Jon: The page on HackThisSite’s server will not change. You merely save your own copy of it, on your own harddrive.

Comment by Tim — May 7, 2007 @ 9:17 pm

okay i so i veiw the source change the email to mine the save it

Comment by Jon — May 8, 2007 @ 4:33 pm

Jon: What do you do after that? You should open the newly saved file on your computer, not the one on hackthissite.org.

Comment by Tim — May 8, 2007 @ 5:22 pm

i exit it out then i send password to sam then nothing happens how do you open the newly saved file on my computer sorry i am really new at this and i want to understand what i am doing

Comment by jon — May 8, 2007 @ 8:22 pm

Jon: FIrst, copy the complete source code from the page. For simplicity’s sake, open Notepad and paste the code there. Now, change the value of the field. After this, open the page that you just saved in Notepad with your web browser. For example, it could be file:///C:\hacking\bw4.html, depending on where you chose to save it.

Comment by Tim — May 9, 2007 @ 6:30 am

hi i am having the same problems as some people above i am really new at this and i am not too sure on what to do but i have saved my own local copy of the source changed the fields to text and my own e-mail adress and tried saving in both htm and html and everytime i click to send the e-mail i get the same message “Error:
You need to be authed to use this page ”

“Error:
You are not authed to use this page ”

can somebody please tell me the problem?

Comment by sam — May 13, 2007 @ 3:34 pm

sam: Are you logged in at the page where you get the error? If not, log in and try again.

Comment by Tim — May 13, 2007 @ 6:01 pm

Tim what do you meen by logged in? i have madde my own local copy of the file in html form and then open it with internet explorer then once i get to the page where it says send password to sam ( or where i have to type my own e-mail adress in, i have tried them both ) once i click the link to send the e-mail it just says something like you are not authed to view this page. do you have any idea what the problem may be?

Comment by sam — May 15, 2007 @ 7:11 pm

sam: Although you use the form from your own local copy of the file, with the field value changed, the form is submitted to HackThisSite, so that Network Security Sam will email the password. HackThisSite has some security measures, which means that you have to be logged in to HackThisSite.org when you submit the form. Good luck.

Comment by Tim — May 15, 2007 @ 8:51 pm

ok but i was logged into the site aswell i’ll keep trying

Comment by sam — May 16, 2007 @ 4:12 pm

tim thank you i have done it now i had to connect to the web page whilst on hackthissite and type it in the url on that page and not just open the file thx again

Comment by sam — May 16, 2007 @ 4:15 pm

I need help i can do all the other ones but this one, i change the email then save it under hackthissite and it is set as a txt under notepad. I do not understand about the uploading the file, how do you upload it so that it is the changed file and not the original. can you explain it step by step please i am new at this and want to be able to understand what i am doing.

Comment by Anonymous — May 17, 2007 @ 5:18 pm

i have made the local copy and edited required fields, but when i open the file in firefox and press “Send Password to Sam” nothing happens, should the local page open an new online page?

Comment by _BlacKouT_ — May 19, 2007 @ 11:48 pm

Anonymous: I am curious as to how you are attempting to upload the file. You should not (and can not) upload it — you should access the new file in your web browser from your own computer, not from HackThisSite.org.

Blackout: What do you mean with that “nothing happens”? Surely, something must happen. Did you remember to change the action attribute?

Comment by Tim — May 20, 2007 @ 3:54 pm

Yeah i have it all sorted now, the action attribute was not changed properly. its quite fussy really isn’t it. needing the .html extension and the http://www. in the action, is this the case in all browsers or just some??

Comment by Blackout — May 20, 2007 @ 4:02 pm

Blackout: Since it’s part of the HTML specifications (see w3.org), it should apply to all browsers. The reason that it is not needed on HackThisSite is that they have the files on the same server, and so only need to refer to them relative to the current path, while you need to refer to them absolutely, since they are on another server.

Comment by Tim — May 21, 2007 @ 12:25 am

ok this is weird. I have been having some trouble with this mission. I’ve done this mission a few different times and each time I would put a different email addy in because i was afraid Gmail or aol wouldn’t work, so i used those and a new yahoo address. Every time i would change the email addy and then run the site, I would get a random text string after clicking the submit button. It would look something like ???/????{++?????????__+:???????? just random a string of characters. After clicking submit i would check my mail to see if it was sent. Well it wasn’t so I took a break off and today I did it on a friends laptop and with the same method as before, and it took me to http://www.hackthissite.org/missions/basic/4/level4.php that just came out and told me the password. kind of like mission 3. So is this how its supposed to work. I thought it was supposed to email it to me. Or does failing the mission over and over just give you the right answer. Anyway thanks for all the help.

Comment by Wrgsta — May 24, 2007 @ 4:31 am

Wrgsta: That’s right, you are told the password after you succeed in changing the email address. As to why it didn’t work on your computer, I unfortunately do not have a clue.

Comment by Tim — May 24, 2007 @ 4:02 pm

why doesnt someone just post the password? my comp is stupid, so i can only enter a pass please just post it up there

Comment by ben — May 28, 2007 @ 4:47 am

ben: Everyone has a different password, and also, you must learn how to do it. Read the original post thoroughly.

Comment by Tim — May 28, 2007 @ 5:59 pm

every time when i click to “send password to sam” it show me this “You need to be authed to use this page”. What to do please tell me.

Comment by poki — June 2, 2007 @ 8:14 pm

thanks

Comment by yuri — June 3, 2007 @ 11:04 am

poki, you need to log in first.

yuri, you’re welcome.

Comment by Tim — June 3, 2007 @ 5:02 pm

many thx!.. I where on the right track but this helpt me figure out the last part. much appriciated

Comment by MltN — June 11, 2007 @ 8:25 pm

Hey everyone i know this site is for learning purposes but see i need to know how to hack into a myspace account. So if anyone can help me with the basics.please i would realy appreciate it.

Comment by UnBorn Hype — June 16, 2007 @ 11:14 am

Its my account but i dont remember the password or email password..so if anyone reads this please i really need on my accout.

Comment by UnBorn Hype — June 16, 2007 @ 11:34 am

ive changed the source code but when i load the page from my HD the button to send doesnt work, what else do i need to do??

Comment by 4ndr3wk — June 21, 2007 @ 1:27 pm

Andrewk: Are you sure that you open what you saved? Also, what is it that doesn’t work?

Comment by Tim — June 23, 2007 @ 11:12 pm

its ok fixed it now, the form elements were local and not absoloute…i feel such a idiot now doh!

thanks for your help anyways!

Comment by 4ndr3wk — June 23, 2007 @ 11:35 pm

hey i did everything from the help menu and did get any where as of solving it i got the email changed but i cant get it on the internet

Comment by neilk — July 7, 2007 @ 5:31 am

hey i did everything from the help menu and did get any where as of solving it i got the email changed but i cant get it on the internet
if u havent noticed this is kind of my first day

Comment by neilk — July 7, 2007 @ 5:32 am

Remember to change the URL from local to absolute (http://hackthissite.org/missions/basic/4/level4.php instead of /missions/basic/4/level4.php). Save the file as e.g. hackthissite.htm, then open it in your web browser.

What does tis local to absolute mean?
Sorry, I’m not an Englishman.

Comment by sausage — July 7, 2007 @ 3:58 pm

Comment by Awesomeness — July 9, 2007 @ 6:11 pm

what does this mean???

Comment by nerablade oe — July 9, 2007 @ 6:13 pm

what does this mean???4g

Comment by nerablade oe — July 9, 2007 @ 6:14 pm

I’m pretty sure I did everything right: downloaded a copy of the page, edited it in Notepad to have my email address and I changed the urls to absolute, but I always get the “You must be authed.” error.

Comment by HackNub — July 11, 2007 @ 1:29 am

HackNub: Make sure that you are logged in.

Comment by Tim — July 12, 2007 @ 9:05 pm

you don’t need doing anything just change hidden to text and save yor page then when you run it and click on submit you will see the password just do all of things that I said don’t do anything else excuse me for my poor english skill

Comment by Behrang — July 13, 2007 @ 9:16 pm

The code will work when you insert ‘www.’ into the code.

action=”http://hackthissite.org/missions/basic/4/level4.php”
method=”post”>

should look like:

action=”http://www.hackthissite.org/missions/basic/4/level4.php”
method=”post”>

Comment by CoffeeGestapo — July 20, 2007 @ 11:19 pm

CoffeeGestapo: Well, that depends on whether you are logged in att http://www.hackthissite.org or just hackthissite.org.

Comment by Tim — July 23, 2007 @ 10:04 pm

every time i do this i follow the instruction and change the email to mine then i click send sam but then this comes up

Error:
You need to be authed to use this page.
can anyone help i tried lots of diffrent ways but cant get it to work

Comment by reece — August 10, 2007 @ 10:26 pm

reece: Make sure that you are logged in to that domain. Just to be sure, be logged in at both http://www.hackthissite.org and http://hackthissite.org

Comment by Tim — August 11, 2007 @ 6:47 pm

OK, guys, I have a question.
So far, I’ve saved the HTML of the site into notepad, and edited the saved version. The only thing I edited was that I changed the “admin@hollabolu.com” or whatever into “___@gmail.com” where the ___ is actually my email address. So, I opened it back up and clicked the button to send “Sam” the code. The button, however, does nothing. Why is that? I press it on the regular site and it goes to a page that says Sam successfully got the email, but when I press it on my (edited) site, the button does nothing.
Any help?

Comment by C.J. Apel — August 12, 2007 @ 7:08 pm

Oh, wow, nevermind.
I forgot to add in the http://www.hackthissite.org. . . into the code. Sorry.

Comment by C.J. Apel — August 12, 2007 @ 7:19 pm

Save the source file with name “hack this site!.htm”!!! It worked… then you just modify the adresses into the htm file!

Comment by maxim4o — August 18, 2007 @ 2:39 pm

nevermind…i got it loL

Comment by pSyChO mOnkee — August 23, 2007 @ 11:56 pm

cant get it! far out!

Comment by mRb — September 13, 2007 @ 1:52 pm

heres what you do so listen up…

1-go into the source code of the page and chose file-save page as

2 change the name of the file to *.html

3 right click the file and hit edit

4 change “webmaster@hulla-ballo” to anthingelse@anythingelse.com

5 press save

6 open

7 press send password to sam

Comment by yo_mamma — September 22, 2007 @ 4:49 pm

Ok, so i viewed the source, saved it to notepad and changed it to my email and that.

Now how do i open it up on the webpage??? i can’t find anything that will let me do that.

Comment by Phenex666 — September 26, 2007 @ 12:46 am

Open it in your web browser of choice.

Comment by Tim — September 27, 2007 @ 4:51 pm

it seems ez enuf to me: I read the first couple posts here, played around with the source and finished the challenge ez. Some of these posts give information that just seems to complicate or confuse…i didn’t get into ‘local’ or ‘validating’ this is all it took for me as I was just playing around:
1. view source
2. save text file to pc
3. change ‘hidden’ to ‘text’ and save file as .html file, then open the page
4. type in email address, click submit, and voila’
thx for all ur posts I am learning a lot!

Comment by hitman024 — October 1, 2007 @ 8:54 am

or maybe try doing this

open the mission and paste

javascript:alert(document.forms[0].to.value)

You’ll see the email set to whats in the source code

then paste

javascript:void(document.forms[0].to.value=”TEST!”)

and then do

javascript:alert(document.forms[0].to.value) again

note the emails changed.

submit it and hey presto

white page with “password: ########”

;-)

Jimmy

Comment by Jimmy06 — October 16, 2007 @ 4:09 pm

EVERYONE MAKE SURE YOU USE THE SOURCE FROM THE ORIGINAL PAGE NOT WHAT IS POSTED ON HERE!!!!!!!!!!

Comment by SaMBRouGHToN — October 16, 2007 @ 6:08 pm

Cool Myspace Layouts…

I couldn’t understand some parts of this article, but it sounds interesting…

Trackback by Cool Myspace Layouts — October 24, 2007 @ 8:28 am

Yeah, if you opened the mission in explorer, saves code from there and save your file as *****.html you’ll get it right!

(I used firefox for opening the mission and explorer to look at my file (”open”) and it didn’t work (because it thought the mission also should be opened in Internet Explorer- so thanks for the tips guys!). Think ‘www.’ could have helped, but I kinda tried everything at once this time.

And if you have to get authed, just log in again and it will “send the password”. If you do it right you will be shown the password afterwards.

good luck!

//nicitha

Comment by Nathalie — October 27, 2007 @ 10:28 am

I have a mac and I do not have Notepad. Is there an alternate form program I can use to edit my own code?

Comment by Roxy — November 8, 2007 @ 9:03 pm

Hi, im a noob hacker. Could u tell me how to open the edited version to the web brouser

Comment by mike — November 9, 2007 @ 6:45 pm

Done it! :) :) :) :)

Comment by mike — November 10, 2007 @ 12:15 pm

Myspace Graphics and Backgrounds, Myspace Stuff…

Sorry, it just sounds like a crazy idea for me :)…

Trackback by Myspace Graphics and Backgrounds, Myspace Stuff — December 5, 2007 @ 2:01 pm

Alright this will not work, I’ve been trying this for like 2 hours at work heres what I’m doing,
first I’ll save the page as html onto the computer then I’ll open the file in notepad change “hidden” to “text” and fill in my email, i then save the file and open it, it opens from the saved destination and then when i try to send sams password i get either error in referral or no response at all, this really shouldn’t be this hard I’ve read all the comments here yet still no luck!!!
Any takers?
thx

Comment by WTS — January 3, 2008 @ 11:00 pm

hey im a complete noob. i can understand html but not write it, so can someone please explain what i should do, step by step? i know how to view source and stuff, but i cant figure out how to edit it and upload it.

ps: im using a mac

Comment by noah — January 25, 2008 @ 12:59 am

im an idiot, i kept entering the site above instead of clicking on send email to sam!

Comment by lol — January 26, 2008 @ 5:21 am

hey guys its really very simple i did it …
just follow the following steps.
1. save the file as a html
2. run it from a already open explorer by going to FILE __>> Open and open file ..
3. the most important part .. the file extensions been updated instead of
http://hackthissite.org/missions/basic/4/level4.php
just use
http://www.hackthissite.org/missions/basic/lvl/non-standard/4pass.php

yoohooo .. you done… Ohh I hope i TRAIN INTO A PROFESSIONAL HACKER SOON ..

Comment by Zack — March 22, 2008 @ 1:43 pm

this is weird. i did not receive any email. instead, the password appears in the webpage after i’ve clicked on “send email to sam”. i’ve tried two version:

version 1:
changed action=”/missions/basic/4/level4.php”
to action=”http://www.hackthissite.org/missions/basic/4/level4.php”

Version 2:
changed the above, since it’s a file in a local computer (need the host address too) and changed the email to my own email.

Both shows the same result (password appears on the webpage instead of my email inbox). Although i’ve passed the level, but not quite understand why?

ANOTHER QUESTIONS:
can i do, like, entering “http://www.hackthissite.org/missions/basic/4/level4.php?to=myName@email.com” to change the recipient? (tried with “%40″ instead of “@” also) Please help! Thanks

Comment by tigerltf — April 4, 2008 @ 10:20 am

regarding to the “ANOTHER QUESTIONS” part, what i mean is entering the “command” or whatever it called (…./level4.php?to=myName@email.com) instead of saving as a local file and altering it.

Comment by tigerltf — April 4, 2008 @ 10:27 am

FUCKIGN BUG

Comment by amle — May 9, 2008 @ 2:55 pm

Whenever I follow these steps I only got a “Password Reminder Successful” message, but the password isn’t displayed.

Help!

Comment by Empire539 — May 15, 2008 @ 2:11 am

same problem with Empire539, help!

Comment by bladeruin — May 15, 2008 @ 11:56 am

Well following from my previous post, I got the email nearly a week after I entered it. So prepare to wait.

I think HTS now uses a real email system for this challenge, but the last time I checked Basic 5 was the same (no email).

Comment by Empire539 — June 19, 2008 @ 7:49 pm

can u explain in detail??
i can’t anything..:’(

Comment by epin — August 3, 2008 @ 9:57 am

can u explain in details??
i can’t understand anything..:’(

Comment by epin — August 3, 2008 @ 9:58 am

thanx 4 ur help. took some tym to know how to modify the page source

Comment by Jo-G — August 10, 2008 @ 8:05 am

OK, I feel like a complete retard here but I hope somebody can help me…

Whenever I copy the source code into Notepad, it gives me no option to save as a html file, only as a txt file. Needless to say not much process can be made.

Comment by James — August 10, 2008 @ 7:26 pm

Got it… oh I feel silly now

Comment by James — August 10, 2008 @ 7:35 pm