Username: 
Password: 
Restrict session to IP 

Challenge: The Cookie is a lie  Go to the The Cookie is a lie challenge

Global Rank: 156
Totalscore: 114740
Posts: 166
Thanks: 156
UpVotes: 109
Registered: 11y 183d
Z`s Avatar



Last Seen: 11d 21h
The User is Offline
Challenge: The Cookie is a lie
Google/translate3Thank You!1Good Post!1Bad Post! link
First of all I'm happy to anounce my new chall.

To make a clean breast for this challenge:

The Portal theme is not important, I only played with this game recently, found cool and was a good theme for this chall. This challenge is an offline challenge. This means you need a working apache + mysql + php environment to solve this challenge. It is because we can't guarantee the site security as far as this challenge is online on wechall, but the good news are that it is not "another fake simulated SQL injection challenge".
The checking of the solutions is offline as well. I hate it, but can't do any application which could check every solution properly. If anyone has any idea for an online solution checker, let me know Smile

If you have no apache + mysql + php environment, I suggest to use xampp on Windows and Linux, and mamp on Mac. After downloading them you can setup a working environment in minutes. But solving the challenge needs some more time.

First you have to setup an admin password for mysql, then login to it with
> mysql -u root -p
after that create a user with:
> create user 'www-user'@'localhost' identified by 'cube';
and create a database with
> create database test;
change database:
> use test;
create table:
> create table experience (id int, filename varchar(500));
and insert a row into it (it is not necessary, but some solutions need it):
> insert into experience values(1,'test');
> commit;
grant privileges:
> grant select on test.* to 'www-user'@'localhost';

Put experience.php_txt under htdocs directory, rename to experience.php, start the apache web server and you can access the experience.php via the webserver like
http://127.0.0.1/experience.php
Now you can test on your own environment. For testing the cookie stealing, you have to create some cookie for the challenge - it should not be hard.

Good luck and don't forget to block every incoming connection to your whole test environment, except localhost Smile


Update: mysql_connect was removed in PHP 7.0.0, please use older version of PHP or refactor the scripts to use mysqli_* functions.
Last edited by Z - May 27, 2018 - 13:17:27
Global Rank: 156
Totalscore: 114740
Posts: 166
Thanks: 156
UpVotes: 109
Registered: 11y 183d
Z`s Avatar



Last Seen: 11d 21h
The User is Offline
Challenge: The Cookie is a lie
Google/translate2Thank You!1Good Post!1Bad Post! link
A small modification was needed in the experience.php
Sorry for the inconvenience.
Last edited by Z - Sep 20, 2008 - 18:09:36
Global Rank: 236
Totalscore: 84568
Posts: 1339
Thanks: 1193
UpVotes: 705
Registered: 11y 191d




Last Seen: 14h 26m
The User is Offline
Challenge: The Cookie is a lie
Google/translate1Thank You!1Good Post!1Bad Post! link
For those who are lazy, here is the link to the new challenge:
The Cookie is a lie

I hope you will like it, and have fun exploiting it.

Happy Challenging
Gizmore
The geeks shall inherit the properties and methods of object earth.
Last edited by Gizmore - Oct 30, 2011 - 19:32:55
Global Rank: 236
Totalscore: 84568
Posts: 1339
Thanks: 1193
UpVotes: 705
Registered: 11y 191d




Last Seen: 14h 26m
The User is Offline
RE: Challenge: The Cookie is a lie
Google/translate0Thank You!0Good Post!0Bad Post! link
*BUMP*

We have a bug here for deleted posts?
The geeks shall inherit the properties and methods of object earth.
Global Rank: 1
Totalscore: 739582
Posts: 387
Thanks: 415
UpVotes: 359
Registered: 10y 29d












The User is Offline
RE: Challenge: The Cookie is a lie
Google/translate1Thank You!1Good Post!0Bad Post! link
Don't think so? You might have been confused because Z edited his post above (probably with "mark as new"). I was, at least. :)
Global Rank: 633
Totalscore: 35520
Posts: 73
Thanks: 34
UpVotes: 37
Registered: 1y 202d
Last Seen: 61d 5h
The User is Offline
RE: Challenge: The Cookie is a lie
Google/translate1Thank You!1Good Post!0Bad Post! link
Hi All,
I sent a PM to GlaDOS (Z) a few days ago and have not gotten a response. Looks like Z has been inactive since February 2019.
Is there an alternative PM to use when Z is out on holiday/vacation or whatever?
Global Rank: 236
Totalscore: 84568
Posts: 1339
Thanks: 1193
UpVotes: 705
Registered: 11y 191d




Last Seen: 14h 26m
The User is Offline
RE: Challenge: The Cookie is a lie
Google/translate0Thank You!0Good Post!0Bad Post! link
spaceone was working on an automated solution.
The state of this is not well known to me, but i guess we will enhance the challenge experience prior to think of removal.
The geeks shall inherit the properties and methods of object earth.
Global Rank: 480
Totalscore: 46549
Posts: 200
Thanks: 175
UpVotes: 173
Registered: 8y 252d
space`s Avatar
The User is Offline
RE: Challenge: The Cookie is a lie
Google/translate1Thank You!1Good Post!0Bad Post! link
Jeah, I have a script which automatically checks the solution. It works for the most obvious ways.
We could activate it either or add this script to the admin panel so that it is easier to check the solution. I am open for both.

If Z doesn't respond you can send me also a PM/email Smile
Contact only via c3BhY2VAd2VjaGFsbC5uZXQ= or PM...
Windows can be secure... but only if you don't use it Happy
Redknee, ckclark, SthwrongA, tunelko, silenttrack, qdxy, TheHiveMind, Z, Ge0, samuraiblanco, arraez, jcquinterov, hophuocthinh, alfamen2, burhanudinn123, Ben_Dover, stephanduran89 have subscribed to this thread and receive emails on new posts.
1 people are watching the thread at the moment.
This thread has been viewed 19905 times.