Hack This Site.co.uk - Main 10

Hack This Site.co.uk - Main 10

Objectives
​Encrypted passwords can be quite difficult to decode, but when you use a common method there is usually a way to get around it. Especially when the encrypted information are simple common words.


Solution

Ok so let's stat by looking at the Source Code

<div class='level-form'>
        <form method="POST">
            <fieldset>
                <label for="user">Username:</label>
                <input type="Text" name="user" id="user" autocomplete="off"><br>
                <label for="user">Password:</label>
                <input type="Password" name="pass" id="pass" autocomplete="off"><br>
                <input type="hidden" name="passwordfile" value="level10pass.txt">
                <input type="submit" value="Submit" class="button">
            </fieldset>
        </form>            </div>
</div>

Ok there is another text file with the creds   level10pass.txt

if we open that file
https://www.hackthis.co.uk/levels/extras/level10pass.txt

we get this
69bfe1e6e44821df7f8a0927bd7e61ef208fdb25deaa4353450bc3fb904abd52:f1abe1b083d12d181ae136cfc75b8d18a8ecb43ac4e9d1a36d6a9c75b6016b61

So this looks like it could be creds   one value then a colon and another value

let's put them through a sha256 hash decrypter
https://md5decrypt.net/en/Sha256/#answer

69bfe1e6e44821df7f8a0927bd7e61ef208fdb25deaa4353450bc3fb904abd52 = carl
f1abe1b083d12d181ae136cfc75b8d18a8ecb43ac4e9d1a36d6a9c75b6016b61 = guess