unforum

[Metlagirl]

5.jpg didn't need a password to be uncamoflaged, but the access code in the document hidden in the picture could be the pass. I don't know what the username is. I've tried every combination I can think of.

[Ethernull]

[Metlagirl]

I hadn't thought of that, that's a good thought. I'd mostly been trying to rack my brains as to what the username and password for the login box are and I'm still not entirely sure what the Table, Eye, Village bit means. That said I'm not getting all that much time to think about it, I have annoying coursework to finish, and then I have to prevent my cat from eating it.

[Ethernull]

ok, I cant figure out how to output the raw code, but I'll explain what I've done so you all can replicate on your end.

Upon viewing the sourcecode of the security login page, I found javascript encoded document.write commands, which means the entire security script is clientside, suggesting the username and password are as well?

so I copied the source, pasted into a new blank local .htm, and changed "document.write" to "alert"

viewed in IE

that showed me the security login script with place holder usernames and passwords, succesful login will forward us to <password>.htm

can someone find a way to output as postable text? My "alert" technique is not selectable text, try it and you'll see what I mean.

In the mean time, I'll dig out my javascript reference...

[Ethernull]

Got it, for those interested, the source code of the security login script is:

[Ethernull]

okay, here is the tool that encrypts the password and username listed in the source on the spoiler above...
http://www.dynamicdrive.com/dynamicindex9/password.htm

From this page we can test known clues and codes against the username field till we find a match, and the password field as well, if we want.

Someone care to figure out how to reverse the algorythm?

Also, is this considered cheating? I'm totaly new to this.

[Metlagirl]

Looking at the encryption program a password of four symbols becomes 7 numbers, a pass of 5 symbols becomes 9 etc. So by that reasoning the username has to 7 symbols long and the pass appears to be 11. Brilliant work Ethernull, I wouldn't have the first idea what to do with javascript. I saw it in the source code but I frankly didn't pay much attention to it.

[Ethernull]

Thanks

Okay, the encryption works like this:

1 * (char value of first character) * (char value of second character) * (char val of 3rd) etc..

[Ethernull]

uhm...

Just a deduction here, but we dont actually need a username. This script takes a password phrase, multiplies it recursively by char values, and if it matches, forwards the browser to <password phrase>.htm

So if we think we have the passphrase, add it with a .htm to the url and see if its right.

[oliverkeers13]

Thou Shalt Not Brute Force

[Ethernull]

[travelling performer?]

[massive]

[ALISDAIRPARK]

Can't beleive we didn't pick try that before! I've tried getting into the site to check previous posts, and also the profile, but can't get into either at the moment

[massive]

From the source of the page itself: