Hack This Site.co.uk - Main 4

Hack This Site.co.uk - Main 4


Objective

hint: ​Sometimes extra hidden fields are added to the form which contains extra information for the login script. Again this is very easy for anyone to gain access to as it is clearly shown in the source code.

Sometimes these fields can contain very important information.


Solution


Let's start with the source code again
here is the section that deals directly with this level

</div>

            <div class='level-form'>
        <form method="POST">
            <fieldset>
                <label for="user">Username:</label>
                <input type="Text" name="user" id="user" autocomplete="off"><br>
                <label for="user">Password:</label>
                <input type="Password" name="pass" id="pass" autocomplete="off"><br>
                <input type="hidden" name="passwordfile" value="../../extras/ssap.xml">
                <input type="submit" value="Submit" class="button">
            </fieldset>
        </form>            </div>
</div>
</div>

oh look there is a password file it checks for the creds.... let see if we can get into that by going straight to the path
https://www.hackthis.co.uk/levels/extras/ssap.xml
yup there are the creds for this level
​<user><name>Admin</name><username>999</username><password>911</password></user>