New challenges

Quote from Gizmore

Have fun exploiting a flaw that has been around on wechall itself for a year !

Actually this flaw only existed between Jan 19 2009 when you "dropped the evil global htmlspecialchars" and Feb 09 2009 when I noticed what you'd done

Hmm, yeah. Might be that the old evil htmlspecialchars were secure

--------------------------------------------------------------------

Anyway i'd like to present you 2 more exploit challenges we were working on lately.

FixUs is thought of by Z and put into code by myself.
Screw SQL is a real life example of a flawed login situation i found on the web.

I hope you like the new exploit challs and i wish you all
Happy Challenging

I added 2 new mini challenges by myself.
There are more, bigger, challenges in the queue

PHP 0815 is kinda php exploit chall, and you are given the source to fix an issue (once again).
You need a userlevel of 1 to see this content.

Hope you like them.
Happy Challenging
Gizmore

I added another challenge by me, which should nicely fit into the previous.
PHP0816 is not the best title, because the same logic error can occur in any language.

happy challenging!

There have been no new challenges for a long time.

Currently, 2 more from Z are in the testing phase, and there is one new from quangntenemy and me

So, WeChall proudly presents a new, unique challenge:

Quangcurrency is kinda exploit challenge. You have to exploit a script to purchase more items than you should be allowed.
The same flaw might exist in other software too, so have fun buying unlimited items!

Many thanks to quangntenemy for the idea making a challenge out of this problem.
Also many thanks to noother, Kender and Hertz, who tested the challenge a bit, and helped to make it better.

Happy Challenging!

I created another challenge, Addslashes, which is a real mysql injection exploit challenge.
You are given the source of the login script that you need to exploit to login as Admin.

Kender gave his OK on the permission of the new database and mysql-user so it`s up and ready to get solved now.

Have fun on exploiting it

Hello Challengers,

Z and Gizmore proudly present 3 new challenges:

Z-Reloaded,
Credit Card Challenge Pwnage! and
Order By Query

Since a lot new challs have been released within the past days, i suggest you sort the challenge table to get an overview of additions.

Here is a summary for the 3 new challs, scroll a few posts up to see older additions.
Z-Reloaded is a basic guide to crack a system, similar to a question and answer game, from Z.
Credit Card Challenge Pwnage! combines mutltiple attacks into one offline challenge to further explore the www, from Z.
Order By Query is a blind sql injection challenge, from Gizmore.


We like to thank all the BetaTesters for their superb help.

Have fun with the new challenges!
Z & Gizmore