Get Into The Admin Page, Database, and Password Lectures (1st study)

Bismillah...

I'm sorry if my english still poor..

A. First, we visited http://172.17.51.105/akakom/ to analyzed and how we could into the admin page

By the way, the odds thing are:

1. From the page source, there are have words "Jogjakarta" and "3133t" which are colored white
2. In the page, if we select all, then the words "Jogjakarta" and "3133t" will appear visible

B. Then we fill in the user with "Jogjakarta" and for password "3133t" (which the quote ain't included)

C. After successfully logged in, we are directed to http://172.17.51.105/akakom/main/index.php

So in the admin page, we have an image akakom logo, sms akakom server, and table of list the students' scores (we get NIM, names, scores, and lecturers).

Fyi, if wrong filled an id and or a password, it will still directed to http://172.17.51.105/akakom/main/index.php, but we will got the informations about few things:
1. Warnings will appeared because wrong filled
2. The logs will be recorded in the webserver log

D. The next task, was to find score in the table from student who got E from lecturers

It could be seen from the table, that the one lecture who gave E was the lecture C and the name of student was "three"

E. The next other order, we searched the database which we got password lecture C and will reported to the number phone from the lecture of network security via SMS server

From analysis on the admin page, that akakom logo image contained in http://172.17.51.105/akakom/main/upload/Lambang% 20Akakom1.jpg

Then we browse http://172.17.51.105/akakom/main/upload/ (without Lambang% 20Akakom1.jpg), so we could see the database file located on the upload folder too..

The name of database was dosen.dat, when opened we got the results:

08232329320:: DosenA:: 0cc175b9c0f1b6a831c399e269772661:: Calculus
0274555999:: DosenB:: 92eb5ffee6ae2fec3ad71c777531578f:: Network Security
08125459658:: DosenC:: 8277e0910d750195b448797616e091ad:: Algorithm
08521932738:: DosenD:: e1671797c52e15f763380b45e841ec32:: Web Programming
08527111087:: DosenE:: e1671797c52e290763380b45e841ec32:: Physics
09826373827:: DosenF:: e167179e982e15f763380b45e841ec32:: Accounting

F. From the informations, we send the message with password lecture C (8277e0910d750195b448797616e091ad) via sms server akakom to the lecture of network security (with number 0274555999)

G. Taraaa, our results are directed to http://172.17.51.105/akakom/main/sms.php and there are large green of text that read "Congratulations You Passed Selection!"



The last but not least, if we sent the sms doesn't match, then we are directed to http://172.17.51.105/akakom/main/sms.php with the warned "The process delivery failed ..!!!!"

Finally, this is our first study 'capture the flag' to the next experiences. We hope that we get much interesting about network security..