SRL Archive - Senior News and General

<Ikiliki[God]> JDB said this on his site:
<Ikiliki[God]> 1.) Freddy1990 is a GMOD at mitb and his site uses out of date SMF software which I am witting a exploit for, if it works then we can hijack his account assuming he uses the same password.
<Ikiliki[God]> JDB said this on his site:
<Ikiliki[God]> 2.) SRL uses out of date software aswell and I have seen two or three POC's for the version they are using, we could hijack a number of people from here.
<Ikiliki[God]> JDB said this on his site:
<Ikiliki[God]> 3.) Lastly, I'm trying to write a working exploit for SMF 1.1.4 since there are no public ones yet to my knowledge.

JDB quit MITB.com, and made several GMod accounts and gave them to complete idiots, I wouldn't take his threats seriously at all, however:

<Ikiliki[God]> Thug-life, CopyRight's
<Ikiliki[God]> omfg lothy
<Ikiliki[God]> they're trying to get sL make a keylogger
<Ikiliki[God]> "The only chance we have at the moment to get another mod account (the way I see it.) is to get a mod to download a keylogger, but most likely if they are mod there they arnt stupid enough to fall for this. Any other ideas?"

It looks like they have(private) a "community destroy" board, and there too pathetic to try anything like a DDOS attack, so they're hoping to keylog someone(they mentioned me… I laughed so hard) and get their users/passes. JDB thinks he can pull an exploit out his ass, and someone thinks they can convince sL(silverlinging) to put a keylogger in a java app(generic bot maybe) and hopefully get a mods login, so I just wanted to warn you guys to put up a security guide.

Thanks for the warning :D

Them seem very fond of their own skills, maybe too fond. But we don't really know if they actually can make "exploits".

If this is possible, it would be pretty great. Force people who are logged in, to write a special password, that can not be filled in by a cookie. That password popup should come every 30th minute. If they log out after 27 minutes, next time they log in and 3 minutes pass they get the pass-popup. That could avoid hijacking, atleast. But it wouldn't be immune to keylogging.

Well, anyways, I have no idea how to do anything so my solutions are always kinda cheesy and lame :p

But theres something I don't get… How did you get this info? and why does it say "<Ikiliki[God]>" in front of every line :S ? Is it a MSN conversation or something? I am very confused.

Again, thanks for the warning.

-Knives

From: King of Knives
But theres something I don't get… How did you get this info? and why does it say "<Ikiliki[God]>" in front of every line :S ? Is it a MSN conversation or something? I am very confused.

It's an [ACRONYM="Internet Relay Chat"]IRC[/ACRONYM] convo.

In all seriousness, the chance of an exploit against both SMF and VB forum software, both being written(or obtained) by a 17(?) year old, and being used to get usernames + passwords of a moderator/admin account only to delete topics that would take 1 click to undo on a forum is just absurd.