The purpose of this demo is to illustrate what can happen when web applications trust user input, rely on client side input validation, and believe ecryption mechanisms solve everything, whether client side checks are performed or not. This web page consists of several poorly written perl scripts to handle user input and serve html pages. Session tracking is not existent.
Input validation is virtually non-existent.
Notice the size of the user name and password entry fields. Try typing in more than 10 characters in either the Name or Password fields. View the HTML source and see where it is controlled. This value will be set to TRUE if the user successfully authenticates. Start Achilles Now and set it to intercept server data.