Dumb if ('1' == '0') question

Collapse
This topic is closed.
X
X
Collapse
 
  • Page of 1
  • Time
  • Show
Clear All
new posts
Previous template Next
  • Stroller
    #1

    Dumb if ('1' == '0') question

    Hi there,

    Please be gentle - I'm never used Javascript, but I need to
    reverse-engineer my router, which my ISP (whom I bought it from) have
    helpfully locked to their service.

    I managed to find a hidden webpage on the router which allows one to
    enter an unlock code, and if I enter (say) 999 in this box it takes me
    to a webpage with the address <http://192.168.1.200/brdg.cgi?brdg=9 99>.
    That page helpfully shows a message announcing "Your router is still
    locked."

    It was my intention to brute-force the unlock code, by writing a
    bash-script to download every URL from
    <http://192.168.1.200/brdg.cgi?brdg=0 > to
    <http://192.168.1.200/brdg.cgi?brdg=9 99999> (or whatever), until
    parsing it reveals the word "unlocked" but it's probably obvious to
    more experienced haX0rz that my script just gets the source of the
    page, including both "locked" and "unlocked" display strings.

    This is where it gets (for me) interesting. The code on the page is:

    <html>
    <head>
    <meta http-equiv="Pragma" content="no-cache">
    <link rel=stylesheet href='stylemain .css' type='text/css'>
    <link rel=stylesheet href='colors.cs s' type='text/css'>
    <title>ISP Lock status</title>
    <script language="javas cript" src="util.js"></script>
    <script language="javas cript">
    <!-- hide
    function frmLoad()
    {
    with ( document.forms[0] )
    {
    if ('1' == '0')
    {
    writit("Your router is successfully unlocked.","brd g");
    }
    else
    {
    writit("Your router is still locked.","brdg" );
    }
    }
    }
    // done hiding -->
    </script>
    </head>
    <body onLoad='frmLoad ()'>
    <form>
    <b>ISP Lock status of your router.<br>
    <div id='brdg'></div>
    <br>
    </form>
    </body>
    </html>

    Am I right in thinking that the "if ('1' == '0')" above equates to "if
    true is false"? And that consequently the router will never display the
    unlocked message? Or am I misreading this code completely? I obviously
    have access to the util.js script, so I'm going to take a look at that
    now, but I'd be very grateful if anyone could indicate whether I'm
    working along the right lines.

    Thanks in advance for any comments,

    Stroller.

    Tags: None
    • Berislav Lopac
      #2
      Re: Dumb if ('1' == '0') question

      Stroller wrote:[color=blue]
      > Hi there,
      >
      > Please be gentle - I'm never used Javascript, but I need to
      > reverse-engineer my router, which my ISP (whom I bought it from) have
      > helpfully locked to their service.
      >
      > I managed to find a hidden webpage on the router which allows one to
      > enter an unlock code, and if I enter (say) 999 in this box it takes me
      > to a webpage with the address
      > <http://192.168.1.200/brdg.cgi?brdg=9 99>. That page helpfully shows a
      > message announcing "Your router is still locked."
      >
      > It was my intention to brute-force the unlock code, by writing a
      > bash-script to download every URL from
      > <http://192.168.1.200/brdg.cgi?brdg=0 > to
      > <http://192.168.1.200/brdg.cgi?brdg=9 99999> (or whatever), until
      > parsing it reveals the word "unlocked" but it's probably obvious to
      > more experienced haX0rz that my script just gets the source of the
      > page, including both "locked" and "unlocked" display strings.
      >
      > This is where it gets (for me) interesting. The code on the page is:
      >
      > <html>
      > <head>
      > <meta http-equiv="Pragma" content="no-cache">
      > <link rel=stylesheet href='stylemain .css' type='text/css'>
      > <link rel=stylesheet href='colors.cs s' type='text/css'>
      > <title>ISP Lock status</title>
      > <script language="javas cript" src="util.js"></script>
      > <script language="javas cript">
      > <!-- hide
      > function frmLoad()
      > {
      > with ( document.forms[0] )
      > {
      > if ('1' == '0')
      > {
      > writit("Your router is successfully unlocked.","brd g");
      > }
      > else
      > {
      > writit("Your router is still locked.","brdg" );
      > }
      > }
      > }
      > // done hiding -->
      > </script>
      > </head>
      > <body onLoad='frmLoad ()'>
      > <form>
      > <b>ISP Lock status of your router.<br>
      > <div id='brdg'></div>
      > <br>
      > </form>
      > </body>
      > </html>
      >
      > Am I right in thinking that the "if ('1' == '0')" above equates to "if
      > true is false"? And that consequently the router will never display
      > the unlocked message? Or am I misreading this code completely? I
      > obviously have access to the util.js script, so I'm going to take a
      > look at that now, but I'd be very grateful if anyone could indicate
      > whether I'm working along the right lines.[/color]

      The code above is probably generated by the CGI script, which basically
      writes the second operator in the '1' == '0' evaluation -- '0' if the number
      is incorrect and '1' if it's correct. In other words, you need to parse not
      for "unlocked", but for '1' == '1'.

      Berislav


        Comment

        • Stroller
          #3
          Re: Dumb if ('1' == '0') question


          Berislav Lopac wrote:[color=blue]
          > Stroller wrote:
          >[color=green]
          > > Am I right in thinking that the "if ('1' == '0')" above equates to[/color][/color]
          "if[color=blue][color=green]
          > > true is false"? And that consequently the router will never display
          > > the unlocked message? Or am I misreading this code completely? I
          > > obviously have access to the util.js script, so I'm going to take a
          > > look at that now, but I'd be very grateful if anyone could indicate
          > > whether I'm working along the right lines.[/color]
          >
          > The code above is probably generated by the CGI script, which[/color]
          basically[color=blue]
          > writes the second operator in the '1' == '0' evaluation -- '0' if the[/color]
          number[color=blue]
          > is incorrect and '1' if it's correct. In other words, you need to[/color]
          parse not[color=blue]
          > for "unlocked", but for '1' == '1'.[/color]

          Ah! Many thanks! I very much appreciate your advice - I'll try that.

          Stroller.

            Comment

            • Tim Slattery
              #4
              Re: Dumb if ('1' == '0') question

              "Stroller" <stroller@bigfo ot.com> wrote:

              [color=blue]
              >Am I right in thinking that the "if ('1' == '0')" above equates to "if
              >true is false"? And that consequently the router will never display the
              >unlocked message?[/color]

              Yup, that's what it says.

              It looks to me like the programmer intended that the only way to get
              the unlock message was to actually modify the code on this page.
              Presumably he (the programmer) might do this for testing, but no end
              user ever would.

              --
              Tim Slattery
              Slattery_T@bls. gov

                Comment

                Previous template Next
                Working...