• 1 Post
  • 339 Comments
Joined 1 year ago
cake
Cake day: June 10th, 2023

help-circle
  • hackmud $19.99 $14.99 (25% off)

    If you’re into scripting or hacking you should check this game out. It’s an interesting twist on the Multi-User Dungeon genre. The game presents mostly as a command-line interface where your goal is to seek out targets to pwn for money/points. NPC targets will have vulnerabilities you need to find and exploit in order to expose a hackable part. Once found you engage hackermode where you’ll have a timelimit to break the target’s security (mostly through bruteforce cracking). The game allows you to write short scripts in JavaScript to automate searching for vulnerabilities and cracking security.

    Being Multi-User, there are other users online doing what you’re doing and you’re free to chat with them and exchange scripts. You’re also free to write malicious scripts that will steal money/points from others who don’t check scripts before running them!

    The part I found cool was that the game mirrors IRL hacking much closer than other hacking games. You’ll often need to submit incorrect data to NPC targets to get an error message that will contain hints about where to go next. Ex. A webpage has “News” and “About Us” sections. You can request a section that doesn’t exist to get an error message that shows all acceptable sections: “News”, “About Us”, or “Employees”. You’ve found a hidden section! Using scripts to send a bunch of mal-formed data at a target and then analyzing which ones generate an exploitable error is part of real-life security testing.

















  • The letters are the front are the protocol you’re accessing the site through. http is for unencrypted webpages and https is for encrypted web pages.

    For a webpage to be encrypted they need a certificate from a certificate authority which verifies the person who asks for the certificate actually runs the server they want the certificate for. The page you link doesn’t have a certificate and so the web page cannot be accessed with https. Your browser should tell you a secure connection could not be made with the server. That’s what it does for me.

    If you’re getting a different page you probably have a virus which is serving fake certificates to your browser and redirecting your traffic to a scam server. You probably shouldn’t be typing passwords into your browser until you fix that.