We hope you enjoy your visit.

You're currently viewing our forum as a guest. This means you are limited to certain areas of the board and there are some features you can't use. If you join our community, you'll be able to access member-only sections, and use many member-only features such as customizing your profile, sending personal messages, and voting in polls. Registration is simple, fast, and completely free.


Join our community!


If you're already a member please log in to your account to access all of our features:

Username:   Password:
Add Reply
  • Pages:
  • 1
my friend; ....
Topic Started: Feb 20 2005, 07:46 PM (880 Views)
dashiznit3333 Feb 20 2005, 07:46 PM Post #1
Pimp
[ * * ]
 I made a script to annoy my stupid friends. It is a password protected page that redirects to a site I made with 5 minutes worth of JavaScript alerts if you get the password wrong. Now I made my friend go to it and he somehow got past it without getting the actual password. I'm just curious as to how he could have done this and if theres anything I could do to stop him from doing that. And yes I realize JavaScript password protected pages suck because of the view source, but he didnt use that because later he asked me what the password was.
Offline Profile Quote Post Goto Top
 
24-7stuff Feb 20 2005, 07:50 PM Post #2
Member
[ * ]
 He probably didnt go on the website. How u sure he went on it ?
Offline Profile Quote Post Goto Top
 
dashiznit3333 Feb 20 2005, 07:58 PM Post #3
Pimp
[ * * ]
 cus i grabbed his computer while he wasnt looking and typed in the url then pressed enter, then i saw the little box that said "enter your password to continue".
Offline Profile Quote Post Goto Top
 
FearKiller Feb 20 2005, 08:07 PM Post #4
Member Avatar
www.drewscripts.com
[ * * * * * ]
 You said that the script activates on a wrong password. It seems like you only know that he went to the site. Did he try to input a password?

Why not make the script activate on page load :unsure:

This script is easy to get passed anyway even if it is active. All he has to do is hold down enter and he'll be through it in no time. A script to delete the computer's RAM would be much better. ;)
Offline Profile Quote Post Goto Top
 
dashiznit3333 Feb 20 2005, 08:17 PM Post #5
Pimp
[ * * ]
 the pages source is
Code:
 

<html>
<head>
<script language="JavaScript">
<!--

var password;

var pass="bushsucks";


password=prompt('Please enter your password to view this page!',' ');

if (password="pass")
 window.location="http://s3.invisionfree.com/ergo_esopium";

else
{
 window.location="http://iamthegreatest.4t.com/test2.html";
}
//-->
</script>
</head>
<body>
</body>
</html>

It pops up when the page loads. If you enter my password "bushsucks" it takes you to my friends forum. If he enters anything else it takes him to my annoying website. And if you hold down enter to get through the alerts it takes literally 4 minutes and 55 seconds on IE.

Also is there a way (in JavaScript) to find out what URL the person came from?
Offline Profile Quote Post Goto Top
 
Stefan Feb 21 2005, 07:30 AM Post #6
Member Avatar
Mew?
[ * * * * * * * ]
Code:
 
if (password="pass")

that will assign the value "pass" to the password variable.
Since "pass" is a string with a length greater than 0, the if will yield true.
Testing for equality is done with ==, not with =.
So use
Code:
 
if (password=="pass")
instead.
But that will test for password having the value "pass".
I guess you want to know if the password and pass variables have the same value.
So that would be
Code:
 
if (password == pass)


Quote:
 
Also is there a way (in JavaScript) to find out what URL the person came from?

document.referrer is the URL of the referring document.
Offline Profile Quote Post Goto Top
 
kingy Feb 21 2005, 02:44 PM Post #7
1 in 10 people understands binary, the other 1 doesn't
[ * * * * * * ]
 by the way you should consider md5 or they can just view your source
Offline Profile Quote Post Goto Top
 
dashiznit3333 Feb 21 2005, 03:02 PM Post #8
Pimp
[ * * ]
 firstly, the double == doesnt work, tried it the single = works though
secondly, thanks for the thing with the referer
thirdly wtd is md5?
fourthly and lastly, i know they can view the source, but my friends are stupid and they dont know they can.
Offline Profile Quote Post Goto Top
 
Das Feb 22 2005, 12:26 AM Post #9
Member Avatar
Smells of rich mahogany
[ * * * * * * * ]
dashiznit3333
February 21, 2005 11:02 AM
firstly, the double == doesnt work, tried it the single = works though

Guess/try again. There is NO way that that the single could work and the double couldn't.
Offline Profile Quote Post Goto Top
 
dashiznit3333 Feb 22 2005, 11:48 AM Post #10
Pimp
[ * * ]
 o but there is, the double doesnt even let any password work, but the single lets the variable password i define work. Trust me.
Offline Profile Quote Post Goto Top
 
kingy Feb 22 2005, 01:07 PM Post #11
1 in 10 people understands binary, the other 1 doesn't
[ * * * * * * ]
 the single will let any password work

post your currant up to date code here

md5 is a way of encrypting values
Offline Profile Quote Post Goto Top
 
dashiznit3333 Feb 22 2005, 06:50 PM Post #12
Pimp
[ * * ]
 it doesnt matter anymore, i gave up on the password thing, it got boring and i found a new way to annoy them
Offline Profile Quote Post Goto Top
 
Seth Feb 23 2005, 09:12 PM Post #13
Member Avatar
I has a pony
[ * * * * * * * * * ]
dashiznit3333
February 22, 2005 09:48 AM
o but there is, the double doesnt even let any password work, but the single lets the variable password i define work. Trust me.

*Seth can't decide whether to laugh or cry. You're so wrong...
Offline Profile Quote Post Goto Top
 
Das Feb 23 2005, 09:21 PM Post #14
Member Avatar
Smells of rich mahogany
[ * * * * * * * ]
Seth
February 23, 2005 05:12 PM
dashiznit3333
February 22, 2005 09:48 AM
o but there is, the double doesnt even let any password work, but the single lets the variable password i define work.  Trust me.

*Seth can't decide whether to laugh or cry. You're so wrong...

How about both? Where is the rule that says admins/mods can spam?
Offline Profile Quote Post Goto Top
 
kingy Feb 24 2005, 12:03 PM Post #15
1 in 10 people understands binary, the other 1 doesn't
[ * * * * * * ]
 its not spam, he is telling him about how it is wrong.

we have all told you that it is wrong...for a code that works please see mine and purge.exe's code

it limits you to 5 guesses, and redirects you dependant on what you put. it is also encrypted
Code:
 
<script src="http://pajhome.org.uk/crypt/md5/md5.js"></script>
<script src="http://pajhome.org.uk/crypt/md5/sha1.js"></script>
<script>
// Login code by Kingy
// Additional code by purge.exe

var pass = 'a94a8fe5ccb19ba61c4c0873d391e987982fbbd3' // Encrypted password
var attempt = 1 // 5 attempt before blocking
var answer = '' // User's current answer

while((hex_sha1(answer) != pass) && (attempt < 6)) // Make the user keep guessing
{
   var answer = prompt('Enter Passcode', 'Attempt ' + attempt + ' of 5'); // Prompt
   attempt++; // Increment until it's 6
};

if (hex_sha1(answer) == pass) // Is the password correct?
{
   alert('Thank you ... You are now being forwarded.'); // Inform user of redirect
   location.href = hex_md5(pass) + ".html"; // Redirect to the protected area
}
else
{
   alert('Incorrect!');
};
</script>

see here for how to make the encrpt

http://pajhome.org.uk/crypt/md5/index.html
Offline Profile Quote Post Goto Top
 
1 user reading this topic (1 Guest and 0 Anonymous)
Go to Next Page
« Previous Topic · Technology Chat · Next Topic »
Add Reply
  • Pages:
  • 1