I'm doing a cyber challenge, and I'm on the first challenge and I'm already out of my depth

I'm doing a cyber challenge, and I'm on the first challenge and I'm already out of my depth.

I'm not even sure where to begin desu.

I need to log into a local site using credentials that are sent over an insecure HTTP connection, using POST and GET.

The challenge is hosted locally on my machine, which means I can't sniff someone logging into it and steal credentials that way.

I have inspected the source code and I can't see any php, despite the file name being login.php

Like I said I'm pretty out of my depth. It's just a CTF challenge, I'm not asking for help hacking an actual site.

Set up Wireshark? Show us source code

wireshark snifffffffffffffffffffffffffffffffffffffffffffff braaaaaaaaaaaaaaaappppppppffffztzzzzzzzzzzz

We don't get access to the actual source, just the "view page source" in a browser is all I can find and it's missing the php

It's a vm set up as the web server, that you don't get the log in for, so it runs in the back and just serves

>I have inspected the source code and I can't see any php,

You only see the HTML generated by the PHP. The idea is probably for you to enter some malformed input which will cause the PHP to spit out a password or whatever.

What will wireshark show me if I'm entering the wrong details?

Of course its missing the php in this way, go read an introduction to php. Php is a backend language which is never served to the frontend (your view page source thingy)

Type 'or 1 = 1 into both fields

I mean ' or 1=1

Alternatively " or 1=1

Not sure but the whitespace is also key

Makes sense. I assumed since I can see the post and gets in firebug that it would be attached to the front end.

I've tried to submit a GET using developer mode to ask for the password and email, that did nothing.

I don't understand this

read a book you lazy cunt

What on, exactly? What is it you're trying to get me to do? An sql exploit? Is this a way to retrieve the user name and password via php?

This

Bump

If you don't understand this you're not fit to take the goddamned challenge.

this

Yeah I can appreciate that. But what am I even supposed to look up to find this out?

>I have inspected the source code and I can't see any php

if you pop a line like that you shouldn't even be doing the challenge, every one knows that php source cannot be seen from the browser..

Intro to CS
Intro to webdev

The 1 or 1 thing is checking for susceptibility to an sql injection

Oh ok how does it do that? What is the purpose of feeding it that?

>the story of OP: a dumb cunt tries a challenge

Yeah pretty much mate