Version 8 has an interesting vulnerability.
- Directory traversal with multiple/remote/14641.py reveals a SHA1 password hash.
- In the publicly available login page, the salt can be accessed and added to the hash:
console.log(hex_hmac_sha1(document.loginform.salt.value, ‘2F635F6D20E3FDE0C53075A84B68FB07DCEC9B03’));
Leave a Reply
You must be logged in to post a comment.