ISA TEST Writeup__hack

Just come out of the hack games, very simple, now only 7 off, is the entry level, nothing can play. http://helloisa.com/

Level 1 take a closer look at the page and the first step in the invasion is to gather all the information that might be of value

PS: It is best to use Google browser or Firefox browser


Enter the found password into the following dialog box
Password:

Right-View Source

	<!--
	。。。 Tips...
	Analyzing the source code of Web pages is a basic skill for hackers
	Now that you've seen the words
	It means you've met the basic requirements for joining us.
	The password to enter the second pass is: 186ba6199019568b69315a0f15ae7547
	。。。 Tips...
	-->

Level 2 See the following string familiar to you.
Please submit your password if you are familiar with it. ~
otfky2zjmgnlowe5mzcxn2vln2u4mmyyzdqxnta2yjq=




Password:

Base64 decoding

Key:91dcfc0ce9a93717ee7e82f2d41506b4

Level 3 The customs clearance password has been given and filled out, but seemingly can not submit AH

Password:

Right-View Source

	This clearance password has been given and filled out, <span class= "Redcolor" > but seemingly can not submit ah </span><br/>
	<!--bypass the local validation </span> of the <span class= "redcolor" > Web page; it's the hacker's essential skills <br/><br/> take a closer look at the code submitted by the form, You'll have an unexpected harvest.-->
	<div>
	<br/>
	<form id= ' form ' action= ' index.php ' method= ' get ' autocomplete= ' off ' onsubmit= ' return check (); " >
	Password: <input name= ' pwd ' type= "text" size= "" value= "e555c3455a0415abbdbb2467fe3edf82"/>
	<input name= ' l ' type= "hidden" value= "3"/>
	<input name= ' A ' type= "hidden" value= "C"/>
	<input type= "Submit" value= "submitted" >
	</form>
	</div>
	<script>
	function Check () {
	if (!form.pwd.value) {
	Alert ("Password cannot be blank");
	}else if (form.pwd.value.length>30) {
	Alert ("Password cannot be longer than 30 digits");
	}else{
	Alert ("Password is e555c3455a0415abbdbb2467fe3edf82");
	Form.pwd.value= ' e555c3455a0415abbdbb2467fe3edf82 ';
	}
	return false;
	}
	</script>

It can be seen that when you click Submit, you will enter the check function, so do not click Submit, submit directly via URL's get parameter

and change the a=s of the URL to A=c

Structural url:http://helloisa.com/test/index.php?l=3&a=c&pwd=e555c3455a0415abbdbb2467fe3edf82

Level 4 below this picture is the logo of the community, the next pass the password is inside Oh ~


Password:

Download picture, Hex (hex editor opens)

Pull to the bottom of a section is not garbled is the key

Key:2b4401c871613d0f80224f9c4317bab4

Level 5 The password is very simple, that is: The owner of the site domain name e-mail
Password:

Whois query

Key:xing3389@126.com level 6 to this, maybe you think the whole test is simple.

How about a hard one, then?
I will not give you any hint, but I can tell you clearly that the password has been given to you.

Password:

F12, check the head.

Set-cookie:isa_level_6_password=1ec8635c58b30741acf1311cb0178edb

Level 7 Our inertia thinking can cause some obstacles to us.
But even if I tell you exactly what the password is,

Are you sure you can pass the customs?

Password:

Slightly pits ...

According to the cue inertial thinking and clearly told

The password is: what