Hackthissite/Realistic/Level3

• Level: Realistic::3 (Peace Poetry: HACKED)
• URL: http://www.hackthissite.org/playlevel/3/
• Difficulty :
• Exercise: A little girl made a website to post poetry related to peace and understanding. American fascists have hacked this website replacing it with Hitler-esque propaganda. Can you repair the website ?

Message: I run this website where people can read and submit peace-related poetry. I am doing this out of good will towards others, and I don't see why I would be making enemies out of this, but some real ass hole hacked my website posting a bunch of ignorant aggressive propaganda on the front page. And I made that website a while ago, and I no longer have access to it. Do you think you can hack in and change it back? Please? Oh, and bonus points if you message me the name of the bastard who did this !

• Solution: There is a comment at the end of the source code of the modified page, indicating that old source has been backed up, as "oldindex.html". By entering it as the new URL, we access the old site. Just copy the entire source code, click on submit poem link, and enter « ../index.html » as poem name and paste content as poem body. Submit and you're done.

We use a vulnerability in the origin website (he same the hackers exploited). The submission form for new poems doesn't check entries. It is easy to erase content of the entire website using this vulnerability!