Write-ups
Personal WebsiteGithubLinkedIn
  • Home
  • Blue Team Labs Online
    • ATT&CK
    • D3FEND
    • Log Analysis - Privilege Escalation
    • Meta
    • Network Analysis – Web Shell
    • Shiba Insider
    • The Planet's Prestige
    • The Report
  • bWAPP
    • HTML Injection - Reflected (GET)
    • HTML Injection - Reflected (POST)
    • HTML Injection - Reflected (URL)
    • HTML Injection - Stored (Blog)
    • iFrame Injection
  • Command Challenge
    • Command Challenge
    • Oops I deleted my bin/ dir :(
    • Twelve Days of Shell
  • CryptoHack
    • General
      • Encoding
        • ASCII
        • Hex
        • Base64
        • Bytes and Big Integers
      • XOR
        • XOR Starter
        • XOR Properties
        • Favourite byte
      • Mathematics
        • Greatest Common Divisor
        • Extended GCD
  • CSAW 2023
    • Baby's First
    • Baby's Third
    • my_first_pwnie
    • target_practice
  • CTFLearn
    • Binary
      • Simple bof
    • Cryptography
      • 5x5 Crypto
      • Base 2 2 the 6
      • Character Encoding
      • Substitution Cipher
      • Tux!
    • Forensics
      • Forensics 101
      • Git Is Good
      • PDF by fdpumyp
      • Pho Is Tasty!
      • PikesPeak
      • Simple Steganography
      • Taking LS
      • WOW.... So Meta
  • CyberDefenders
    • BlackEnergy
    • Emprisa Maldoc
    • HawkEye
    • HoneyBOT
    • Insider
    • Obfuscated
    • PacketMaze
    • RE101
    • Redline
    • XLM Macros
  • DVWA
    • Brute Force
    • Command Injection
    • CSRF
    • SQL Injection
    • SQL Injection (Blind)
    • Weak Session IDs
    • XSS (DOM)
    • XSS (Reflected)
    • XSS (Stored)
  • Ethernaut
    • 00 - Hello Ethernaut
  • Exploit Education
    • Protostar
      • Stack Zero
      • Stack One
      • Stack Two
      • Stack Three
      • Stack Four
      • Format Zero
  • Google CTF - Beginner's Quest
    • 0000
    • 1837
    • 1943
    • 1965
    • 1987
    • 1988
    • 1989
    • 1990
    • 1994
  • Hacker101
    • Postbook
  • LetsDefend
    • DFIR
      • Phishing
        • Email Analysis
        • Phishing Email
  • Microcorruption
    • New Orleans
    • Sydney
    • Hanoi
    • Reykjavik
    • Cusco
  • NetGarage IO
    • level 1
    • level 2
  • OverTheWire
    • Bandit
  • PicoCTF
    • Forensics
      • information
    • Binary Exploitation
      • Stonks
    • Web Exploitation
      • Cookies
      • dont-use-client-side
      • GET aHEAD
      • Includes
      • Insp3ct0r
      • Insect HTML
      • login
      • where are the robots
  • PortSwigger labs
    • Client-side topics
      • Cross-site scripting (XSS)
        • Reflected XSS into HTML context with nothing encoded
        • Stored XSS into HTML context with nothing encoded
        • DOM XSS in document.write sink using source location.search
        • DOM XSS in innerHTML sink using source location.search
        • DOM XSS in jQuery anchor href attribute sink using location.search source
        • DOM XSS in jQuery selector sink using a hashchange event
        • Reflected XSS into attribute with angle brackets HTML-encoded
        • Stored XSS into anchor href attribute with double quotes HTML-encoded
    • Server-side topics
      • SQL injection
        • SQL injection vulnerability in WHERE clause allowing retrieval of hidden data
        • SQL injection vulnerability allowing login bypass
        • SQL injection attack, querying the database type and version on Oracle
        • SQL injection attack, querying the database type and version on MySQL and Microsoft
        • SQL injection attack, listing the database contents on non-Oracle databases
        • SQL injection attack, listing the database contents on Oracle
        • SQL injection UNION attack, determining the number of columns returned by the query
        • SQL injection UNION attack, finding a column containing text
        • SQL injection UNION attack, retrieving data from other tables
        • SQL injection UNION attack, retrieving multiple values in a single column
      • Authentication
        • Username enumeration via subtly different responses
        • Password reset broken logic
        • Username enumeration via different responses
        • 2FA simple bypass
      • Path traversal
        • File path traversal, traversal sequences stripped non-recursively
        • File path traversal, traversal sequences blocked with absolute path bypass
        • File path traversal, simple case
        • File path traversal, traversal sequences stripped with superfluous URL-decode
        • File path traversal, validation of start of path
        • File path traversal, validation of file extension with null byte bypass
      • Command injection
        • Blind OS command injection with output redirection
        • OS command injection, simple case
        • Blind OS command injection with time delays
      • Business logic vulnerabilities
        • Flawed enforcement of business rules
        • Excessive trust in client-side controls
        • Inconsistent security controls
        • High-level logic vulnerability
      • Information disclosure
        • Authentication bypass via information disclosure
        • Source code disclosure via backup files
        • Information disclosure on debug page
        • Information disclosure in error messages
      • Access control
        • Referer-based access control
        • Multi-step process with no access control on one step
        • Insecure direct object references
        • URL-based access control can be circumvented
        • Method-based access control can be circumvented
        • User ID controlled by request parameter with password disclosure
        • User ID controlled by request parameter with data leakage in redirect
        • User ID controlled by request parameter, with unpredictable user IDs
        • User ID controlled by request parameter
        • User role can be modified in user profile
        • Unprotected admin functionality with unpredictable URL
        • Unprotected admin functionality
        • User role controlled by request parameter
      • Server-side request forgery (SSRF)
        • Basic SSRF against another back-end system
        • Basic SSRF against the local server
        • SSRF with blacklist-based input filter
      • XXE injection
        • Exploiting XXE to perform SSRF attacks
        • Exploiting XXE using external entities to retrieve files
  • Pwn College
    • Assembly Crash Course
    • Building a Web Server
    • Cryptography
    • Debugging Refresher
    • Intercepting Communication
    • Memory Errors
    • Program Interaction
    • Program Misuse
    • Reverse Engineering
    • Sandboxing
    • Shellcode Injection
    • Talking Web
    • Web Security
  • pwanable.kr
    • fd
    • random
  • Root Me
    • App - System
      • ELF x86 - Stack buffer overflow basic 1
    • Web - Client
      • HTML-disabled buttons
      • Javascript - Authentication
      • Javascript - Source
      • Javascript - Authentication 2
      • Javascript - Obfuscation 1
      • Javascript - Obfuscation 2
      • Javascript - Native code
    • Web - Server
      • HTML - Source code
      • HTTP - IP restriction bypass
      • HTTP - Open redirect
      • HTTP - User-agent
      • PHP - Command injection
      • HTTP - Directory indexing
      • HTTP - Headers
      • HTTP - POST
      • HTTP - Improper redirection
      • HTTP - Verb tampering
      • Install files
  • ROP Emporium
    • ret2win
    • split
  • TryHackMe
    • Easy
      • Agent Sudo
      • Anthem
      • Archangel
      • Bounty Hacker
      • Brooklyn Nine Nine
      • Brute It
      • c4ptur3-th3-fl4g
      • Chill Hack
      • Crack the Hash
      • CTF collection Vol.1
      • Cyborg
      • Fowsniff CTF
      • GamingServer
      • h4cked
      • LazyAdmin
      • Lian_Yu
      • OhSINT
      • Overpass
      • Pickle Rick
      • RootMe
      • Searchlight - IMINT
      • Simple CTF
      • Startup
      • Sudo Security Bypass
      • tomghost
      • Wgel CTF
      • Year of the Rabbit
    • Medium
      • Anonymous
      • ConvertMyVideo
      • UltraTech
  • Under The Wire
    • Century
    • Cyborg
  • W3Challs
    • Web
      • Change your browser
  • Websec.fr
    • level01
    • level04
    • level17
    • level25
    • level28
Powered by GitBook
On this page

Was this helpful?

  1. Root Me
  2. Web - Client

Javascript - Obfuscation 1

Last updated 1 year ago

Was this helpful?

Let's check the source code with CTRL + U.

We can see that the password is Hex-encoded.

We can decode it using the decodeURI function.

> decodeURI("%63%70%61%73%62%69%65%6e%64%75%72%70%61%73%73%77%6f%72%64")
<- 'cpasbiendurpassword'

Let's enter the decoded password.

Password

cpasbiendurpassword