jazzc
Elite Member
- Jan 27, 2009
- 2,964
- 14,717
I am a strong believer that security in programming is a mindset and not an add-on. I will be making a few posts with non standard security problems in PHP. Of course, they are not mine, I just tweaked them enough to hopefully avoid easy detection. Credit goes where it 's due.
If you manage to solve them by yourself (i.e. without your googling sk14z), big kudos
Here is the first one - you must help Brain send the message to Pinky to start the world conquest. Can you do it?
Brain has a big collection of cookies in the kitchen - but he 's at a loss of which one to use. Come on, bake the proper one
Edit: Brain has no knowledge what the username/password combo is. You can't use that info as a solution. I 've put it there to signify just the fact that there program successfully gets the stored value from somewhere (db, file, api, whatever) with some code we don't need to know for our purposes.
Edit 2: PM me the solution, don't post it
If you manage to solve them by yourself (i.e. without your googling sk14z), big kudos
Here is the first one - you must help Brain send the message to Pinky to start the world conquest. Can you do it?
PHP:
$cachedCredentials = unserialize($cookieVal);
// Assume we successfully retrieved $user & $pass before somehow
$user = 'admin';
$pass = 'root11';
if ($cachedCredentials['username'] == $user && $cachedCredentials['password'] == $pass) {
$loggedIn = true;
} else {
$loggedIn = false;
}
if ($loggedIn) {
Pinky::conquerUniverse();
}Brain has a big collection of cookies in the kitchen - but he 's at a loss of which one to use. Come on, bake the proper one
Edit: Brain has no knowledge what the username/password combo is. You can't use that info as a solution. I 've put it there to signify just the fact that there program successfully gets the stored value from somewhere (db, file, api, whatever) with some code we don't need to know for our purposes.
Edit 2: PM me the solution, don't post it
