Username: 
Password: 
Restrict session to IP 

Challenge: The Cookie is a lie  Go to the The Cookie is a lie challenge

Global Rank: 158
Totalscore: 114683
Posts: 166
Thanks: 158
UpVotes: 114
Registered: 12y 102d
Z`s Avatar



Last Seen: 234d 1h
The User is Offline
Challenge: The Cookie is a lie
Google/translate3Thank You!1Good Post!1Bad Post! link
First of all I'm happy to anounce my new chall.

To make a clean breast for this challenge:

The Portal theme is not important, I only played with this game recently, found cool and was a good theme for this chall. This challenge is an offline challenge. This means you need a working apache + mysql + php environment to solve this challenge. It is because we can't guarantee the site security as far as this challenge is online on wechall, but the good news are that it is not "another fake simulated SQL injection challenge".
The checking of the solutions is offline as well. I hate it, but can't do any application which could check every solution properly. If anyone has any idea for an online solution checker, let me know Smile

If you have no apache + mysql + php environment, I suggest to use xampp on Windows and Linux, and mamp on Mac. After downloading them you can setup a working environment in minutes. But solving the challenge needs some more time.

First you have to setup an admin password for mysql, then login to it with
> mysql -u root -p
after that create a user with:
> create user 'www-user'@'localhost' identified by 'cube';
and create a database with
> create database test;
change database:
> use test;
create table:
> create table experience (id int, filename varchar(500));
and insert a row into it (it is not necessary, but some solutions need it):
> insert into experience values(1,'test');
> commit;
grant privileges:
> grant select on test.* to 'www-user'@'localhost';

Put experience.php_txt under htdocs directory, rename to experience.php, start the apache web server and you can access the experience.php via the webserver like
http://127.0.0.1/experience.php
Now you can test on your own environment. For testing the cookie stealing, you have to create some cookie for the challenge - it should not be hard.

Good luck and don't forget to block every incoming connection to your whole test environment, except localhost Smile


Update: mysql_connect was removed in PHP 7.0.0, please use older version of PHP or refactor the scripts to use mysqli_* functions.
Last edited by Z - May 27, 2018 - 13:17:27
Global Rank: 158
Totalscore: 114683
Posts: 166
Thanks: 158
UpVotes: 114
Registered: 12y 102d
Z`s Avatar



Last Seen: 234d 1h
The User is Offline
Challenge: The Cookie is a lie
Google/translate2Thank You!1Good Post!1Bad Post! link
A small modification was needed in the experience.php
Sorry for the inconvenience.
Last edited by Z - Sep 20, 2008 - 18:09:36
Global Rank: 235
Totalscore: 84997
Posts: 1367
Thanks: 1213
UpVotes: 732
Registered: 12y 110d




Last Seen: 13d 7h
The User is Offline
Challenge: The Cookie is a lie
Google/translate1Thank You!1Good Post!1Bad Post! link
For those who are lazy, here is the link to the new challenge:
The Cookie is a lie

I hope you will like it, and have fun exploiting it.

Happy Challenging
Gizmore
The geeks shall inherit the properties and methods of object earth.
Last edited by Gizmore - Oct 30, 2011 - 19:32:55
Global Rank: 235
Totalscore: 84997
Posts: 1367
Thanks: 1213
UpVotes: 732
Registered: 12y 110d




Last Seen: 13d 7h
The User is Offline
RE: Challenge: The Cookie is a lie
Google/translate0Thank You!0Good Post!0Bad Post! link
*BUMP*

We have a bug here for deleted posts?
The geeks shall inherit the properties and methods of object earth.
Global Rank: 1
Totalscore: 751168
Posts: 402
Thanks: 443
UpVotes: 393
Registered: 10y 313d












The User is Offline
RE: Challenge: The Cookie is a lie
Google/translate1Thank You!1Good Post!0Bad Post! link
Don't think so? You might have been confused because Z edited his post above (probably with "mark as new"). I was, at least. :)
Global Rank: 643
Totalscore: 35598
Posts: 74
Thanks: 36
UpVotes: 41
Registered: 2y 121d
Last Seen: 34d 10h
The User is Offline
RE: Challenge: The Cookie is a lie
Google/translate1Thank You!1Good Post!0Bad Post! link
Hi All,
I sent a PM to GlaDOS (Z) a few days ago and have not gotten a response. Looks like Z has been inactive since February 2019.
Is there an alternative PM to use when Z is out on holiday/vacation or whatever?
Global Rank: 235
Totalscore: 84997
Posts: 1367
Thanks: 1213
UpVotes: 732
Registered: 12y 110d




Last Seen: 13d 7h
The User is Offline
RE: Challenge: The Cookie is a lie
Google/translate0Thank You!0Good Post!0Bad Post! link
spaceone was working on an automated solution.
The state of this is not well known to me, but i guess we will enhance the challenge experience prior to think of removal.
The geeks shall inherit the properties and methods of object earth.
Global Rank: 490
Totalscore: 46547
Posts: 200
Thanks: 179
UpVotes: 178
Registered: 9y 171d
space`s Avatar
The User is Offline
RE: Challenge: The Cookie is a lie
Google/translate1Thank You!1Good Post!0Bad Post! link
Jeah, I have a script which automatically checks the solution. It works for the most obvious ways.
We could activate it either or add this script to the admin panel so that it is easier to check the solution. I am open for both.

If Z doesn't respond you can send me also a PM/email Smile
Contact only via c3BhY2VAd2VjaGFsbC5uZXQ= or PM...
Windows can be secure... but only if you don't use it Happy
Redknee, ckclark, SthwrongA, tunelko, silenttrack, qdxy, n0tHappy, TheHiveMind, Z, Ge0, samuraiblanco, arraez, jcquinterov, hophuocthinh, alfamen2, burhanudinn123, Ben_Dover, stephanduran89, braddie0 have subscribed to this thread and receive emails on new posts.
1 people are watching the thread at the moment.
This thread has been viewed 20114 times.