circusmonkey404's Security Site

Hack This Site.co.uk - Main 3 Objectives Hint: ​Using JavaScript as the only method to secure your site is a bad idea, but this has obviously been over looked while coding this page. Solution The hint says we should look in the code again specifically at any scripts inside. I found this script which checks the creds against hard coded creds <div class="page-wrap">          <script type='text/javascript'> $(function(){ $('.level-form').submit(function(e){ if(document.getElementById('user').value == 'heaven' && document.getElementById('pass').value == 'hell') { } else { e.preventDefault(); alert('Incorrect login') } })})</script>         <div id="header-wrap" class="container clr">             <header>                 <div class="col span_11 banner">                     <a href='/'>&nbsp;</a>                 </