i have to agree with LB on this. if i write a php script to redirect you, there is nothing you can about it short of making a hack in [insert browser of choice here]. you cant really control being redirected off the page. you can however stop something from redirecting to another page (my dad works for a company that writes web filters so i found that interesting)
I already wrote "It is a training challenges for educational purpose". I means it is a legal hack challenge and there are people who solved it (but very few) . The problem is that I tried many attack techniques to bypass the URL redirection from access.php to denied.php but I failed.
"you can however stop something from redirecting to another page"
according to me , I tried firefox extension (Noredirect). It stopped the redirection but the page became blank .It seems that the site is not vulnerable against this type of attack.
But if you have another idea or technique , you can tell me .
another thing: the site of challenge show a cookie
so I tried
five type of attack:
cookie poisoning attack
cookie injection attack
cookie hijacking attack
session fixation attack
but I did not succeed
so any idea on how to proceed???
as I said it is a CHALLENGE FOR EDUCATION PURPOSE AND IT IS LEGAL AND HAS NOTHING TO DO WITH ILLEGAL ACTIONS OR SOME OF THE SORT
I'd look into using something like Tamper Data to let you inspect and modify the HTTP request being sent to the server. That could give you the insight you need.
Is there anywhere you could specify a path, other than the URL bar? Or perhaps you could try changing the URL if there is a directory and using its parent directory to access the file, e.g. "http://www.example.com/secret/../access.php"
no one has said it is to the best of my knowledge so please calm down. can you show us the other submissions? because the only one to have any inkling so far is chrisname (which doesnt surprise me tbh) and three other x web devs (well idk what Ess is) dont know how to do it
Imagine you're at the post office. You head for one of the counters and it has a sign in front of it saying "closed. Use next window". At that point, there's two things you can do: you can go to the next window, or you can stand there staring at the sign and the empty chair. There's certainly nothing you can do that will make the person who is not there do whatever it is you need done.
The same thing is happening here. When you loaded http://www.example.com/access.php, you actually did get a response: a blank page plus a redirect (redirects aren't part of a page's content). The blank page is the content. You can choose to not follow the redirect, but that won't get you any more data than you already have.