Monday, May 10, 2010

Web Security Challenge 3

Another challenge on "Encoding attacks for Web applications".

Many web sites do not use SSL encryption for their web application (including login pages). You can easily extract or manipulate data during the communication between the client and the server.

This challenge is a simple challenge. You are required to extract the "password" from the simulated user login and verify the capture password by logging in with it. For this challenge, You will learn and understand on how to capture web communication between the client and the server. This will be the fundamental for further challenges on code injection.

The challenge was created with simple HTML and PHP.
The URL: Email me if you interested

* Do not extract the password from the source code. You are suppose to extract it from the communication.
* It is a code challenge, extract the data not crack the server.

Technical resources:
- Some readup on HTTP and Request methods
- WebScarab, a good tool by OWASP
- Another good web security tools

- Previously did a video on extracting user's credential on unsecured website

Feel free to provide comments on this challenge.

No comments: