The getadmin contest show us the danger of enabling the register_globals directive in PHP. Looking into the source code, you can see that it is a simple form:
Level 1 – getadmin
Level 3 – fortune
Take a look into the source code:
A simple GET form with an interesting comment:
<!-- fortune files are in fortunes/ directory -->
This is a clue!
Level 6 – shop
This screenshot, as rendered in Firefox, doesn’t shows all the text (maybe the web designer must enlarge the iframe container) :-P
Let’s do it:
