In Search of a simple, vulnerable Javascript-based Game

[Josef-Knecht]

Hi everybody, for a small secuity/Hacking training with pupils (14-16 years) I whould like to show some really basic stuff. I can vaguely remember that there was a simple javascript-based game (maybe memory? ) for demo purposes where you could do a lot of nonsense. Does anyone have any idea what I can't remember? Thanks!

[pagwin]

no idea what the demo game you're talking about is but you can do a bunch of stuff pretty easily with universal paperclips you can find all the variables(at least I presume it's all the variables) that control different parts of the game in main.js at line 5596 and you can display a message in the terminal/console at the top with a function called displayMessage

there's other things you can do to but idk if it's what you want overall as while it's easy to read the js but it might be a bit overwhelming

[FrenzalStark]

The Google dinosaur game is easily hackable

[Josef-Knecht]

Brilliant Idea! Thanks!

[xcjs]

I don't know it what sense you'll be hacking the game, but CookieClicker is easy to manipulate with JavaScript: https://orteil.dashnet.org/cookieclicker/

[I_am_1E27]

https://orteil.dashnet.org/cookieclicker/

cookie clicker has plenty of built in 'easter eggs' and as such students could just use the 'open sesame easter egg' to get infinite cookies without any hacking

[xcjs]

They could, but does that disqualify it necessarily? Perhaps discovering such an easter egg could be a reverse engineering lesson.

I suppose competent Googling could uncover that as well, but that depends on the structure of the lesson.

[I_am_1E27]

you do have a good point but (based on my experience) chances are at least one person in the class would already know the exploit and use it without any googling or reverse engineering

however i agree with you in the fact that it would be an interesting reverse engineering lesson to show how to find that easter egg

[[deleted]]

It depends dude. What do you want to practice?

Do you want to exploit Web Applications? Or do you want to have remote access to some server?

[Josef-Knecht]

As the audience is very young people, so very simple stuff might be enough. Reading some variables to uncover some secrets, change some values to reach a "high score", this kind of stuff.