Lab Worksheet – The art of the hack

Lab Worksheet: “Find the Weak Link” – Web Source Code Investigation
Objective: Simulate a real hacker’s reconnaissance and discovery phase using browser developer tools to find simple web vulnerabilities in a public challenge site.

---

⚙️ Requirements

• Any modern web browser (Chrome, Firefox, Edge)
• Built-in Developer Tools (press F12)
• One of the following websites:
  • HackThisSite – Basic Missions
  • Google XSS Game
  • PentesterLab Web for Pentester

---

🔍 Instructions

Step 1 – Open the Challenge

1. Navigate to the chosen challenge URL.
2. Read the challenge description carefully — understand what the site is asking you to do.
3. Without using any tools yet, try interacting with the page normally (e.g., submitting a form or clicking buttons) to see how it behaves.

Step 2 – Open Developer Tools

1. Open the browser’s Developer Tools by pressing F12 or right-clicking and choosing “Inspect.”
2. Use the Elements tab to view the structure of the page (HTML).
3. Use the Console or Sources tab to explore any JavaScript.

Step 3 – Analyze the Page

Look for the following clues in the page source:

• Comments in HTML that contain hints or credentials.
• JavaScript code that verifies input on the client side.
• Hardcoded variables, passwords, or access flags.
• Hidden form fields or values not visible on the main page.

Step 4 – Try to Manipulate Inputs

1. Edit input fields directly in the Developer Tools (e.g., change a hidden field or default username).
2. Resubmit the form with modified data to bypass basic checks.
3. Try injecting unexpected input (e.g., special characters) into form fields to see how the site reacts.

Step 5 – Trigger the “Win” Condition

1. Observe what happens when the site responds with a success message or a flag.
2. Note whether the site reveals anything sensitive or gives access to the next stage.

Step 6 – Understand the Vulnerability

Once the flaw is discovered, mentally answer:

• What type of weakness allowed the page to be bypassed?
  • Was it exposed information?
  • A logic flaw?
  • Lack of validation?
• How could a real developer fix this issue (e.g., server-side validation, remove client-side secrets, sanitize inputs)?

Step 7 – Ethics Reminder

• This exercise is done with permission, on safe environments designed for practice.
• In real life, hacking without permission is illegal.
• Cyber Rangers always hack ethically: to learn, to defend, and to improve the world.

---

✅ Summary

This lab simulates the reconnaissance and early exploitation phases of a real cyberattack — but in a safe, legal, educational setting.
You used built-in browser tools to inspect source code, analyze site behavior, and identify logic flaws or security weaknesses — just like ethical hackers do in real-world security testing.