Username: 
Password: 
Restrict session to IP 

Challenge: The Cookie is a lie  Go to the The Cookie is a lie challenge

Global Rank: 170
Totalscore: 115606
Posts: 166
Thanks: 162
UpVotes: 119
Registered: 16y 34d
Z`s Avatar



Last Seen: 210d 7h
The User is Offline
Challenge: The Cookie is a lie
Google/translate3Thank You!1Good Post!1Bad Post! link
First of all I'm happy to anounce my new chall.

To make a clean breast for this challenge:

The Portal theme is not important, I only played with this game recently, found cool and was a good theme for this chall. This challenge is an offline challenge. This means you need a working apache + mysql + php environment to solve this challenge. It is because we can't guarantee the site security as far as this challenge is online on wechall, but the good news are that it is not "another fake simulated SQL injection challenge".
The checking of the solutions is offline as well. I hate it, but can't do any application which could check every solution properly. If anyone has any idea for an online solution checker, let me know Smile

If you have no apache + mysql + php environment, I suggest to use xampp on Windows and Linux, and mamp on Mac. After downloading them you can setup a working environment in minutes. But solving the challenge needs some more time.

First you have to setup an admin password for mysql, then login to it with
> mysql -u root -p
after that create a user with:
> create user 'www-user'@'localhost' identified by 'cube';
and create a database with
> create database test;
change database:
> use test;
create table:
> create table experience (id int, filename varchar(500));
and insert a row into it (it is not necessary, but some solutions need it):
> insert into experience values(1,'test');
> commit;
grant privileges:
> grant select on test.* to 'www-user'@'localhost';

Put experience.php_txt under htdocs directory, rename to experience.php, start the apache web server and you can access the experience.php via the webserver like
http://127.0.0.1/experience.php
Now you can test on your own environment. For testing the cookie stealing, you have to create some cookie for the challenge - it should not be hard.

Good luck and don't forget to block every incoming connection to your whole test environment, except localhost Smile


Update: mysql_connect was removed in PHP 7.0.0, please use older version of PHP or refactor the scripts to use mysqli_* functions.
Last edited by Z - May 27, 2018 - 13:17:27
Global Rank: 170
Totalscore: 115606
Posts: 166
Thanks: 162
UpVotes: 119
Registered: 16y 34d
Z`s Avatar



Last Seen: 210d 7h
The User is Offline
Challenge: The Cookie is a lie
Google/translate2Thank You!1Good Post!1Bad Post! link
A small modification was needed in the experience.php
Sorry for the inconvenience.
Last edited by Z - Sep 20, 2008 - 18:09:36
Global Rank: 252
Totalscore: 87267
Posts: 1635
Thanks: 1336
UpVotes: 885
Registered: 16y 42d




Last Seen: 1h 24m
The User is Offline
Challenge: The Cookie is a lie
Google/translate1Thank You!1Good Post!1Bad Post! link
For those who are lazy, here is the link to the new challenge:
The Cookie is a lie

I hope you will like it, and have fun exploiting it.

Happy Challenging
Gizmore
The geeks shall inherit the properties and methods of object earth.
Last edited by gizmore - Oct 30, 2011 - 19:32:55
Global Rank: 252
Totalscore: 87267
Posts: 1635
Thanks: 1336
UpVotes: 885
Registered: 16y 42d




Last Seen: 1h 24m
The User is Offline
RE: Challenge: The Cookie is a lie
Google/translate0Thank You!0Good Post!0Bad Post! link
*BUMP*

We have a bug here for deleted posts?
The geeks shall inherit the properties and methods of object earth.
Global Rank: 1
Totalscore: 760035
Posts: 431
Thanks: 491
UpVotes: 456
Registered: 14y 246d












The User is Offline
RE: Challenge: The Cookie is a lie
Google/translate1Thank You!1Good Post!0Bad Post! link
Don't think so? You might have been confused because Z edited his post above (probably with "mark as new"). I was, at least. :)
Global Rank: 773
Totalscore: 33028
Posts: 74
Thanks: 38
UpVotes: 48
Registered: 6y 53d
Last Seen: 2y 283d
The User is Offline
RE: Challenge: The Cookie is a lie
Google/translate1Thank You!1Good Post!0Bad Post! link
Hi All,
I sent a PM to GlaDOS (Z) a few days ago and have not gotten a response. Looks like Z has been inactive since February 2019.
Is there an alternative PM to use when Z is out on holiday/vacation or whatever?
Global Rank: 252
Totalscore: 87267
Posts: 1635
Thanks: 1336
UpVotes: 885
Registered: 16y 42d




Last Seen: 1h 24m
The User is Offline
RE: Challenge: The Cookie is a lie
Google/translate0Thank You!0Good Post!0Bad Post! link
spaceone was working on an automated solution.
The state of this is not well known to me, but i guess we will enhance the challenge experience prior to think of removal.
The geeks shall inherit the properties and methods of object earth.
Global Rank: 542
Totalscore: 46341
Posts: 220
Thanks: 205
UpVotes: 214
Registered: 13y 104d
space`s Avatar
The User is Offline
RE: Challenge: The Cookie is a lie
Google/translate1Thank You!1Good Post!0Bad Post! link
Jeah, I have a script which automatically checks the solution. It works for the most obvious ways.
We could activate it either or add this script to the admin panel so that it is easier to check the solution. I am open for both.

If Z doesn't respond you can send me also a PM/email Smile
Contact only via c3BhY2VAd2VjaGFsbC5uZXQ= or PM...
Windows can be secure... but only if you don't use it Happy
Redknee, ckclark, SthwrongA, tunelko, silenttrack, n0tHappy, quangntenemy, TheHiveMind, Z, balicocat, Ge0, samuraiblanco, arraez, jcquinterov, hophuocthinh, alfamen2, burhanudinn123, Ben_Dover, stephanduran89, braddie0, SwolloW, dangarbri have subscribed to this thread and receive emails on new posts.
1 people are watching the thread at the moment.
This thread has been viewed 22195 times.