SRL Archive - RuneScape News and General

Full Story Marshviperx Massive Runescape Hack - Damage Incorporated

…the legendary hacker MarshviperX(hacked the old nites account, found the first bloodrune dupe, was responsible for the 2002 starcraft surge and the warhammer highscore hack) has recently claimed that he is about to perform the biggest account hacking in MMORPG history on thousands of runescape accounts. He reckons he has found a vulnerability in the java login script and can gain access to anyones account he wants and that he has made a bot so that he can hack a shitload at once making the rs char drop all items in their bank to get into the guinness world record for online game hacking. He is planning to do all this at 12 on new years eve…

Username list to be hacked (8MB+)

usernameList.txt

proxy list

pastebin - collaborative debugging tool



Discuss.

I have no idea if it's feasible or not, but I hope he does it.

It'd be hilarious.

Aah damned, my 2 runescape accounts didn't made it to the usernamelist :(
I hope so much that this is true :D please let it be real… I would lol so hard.
freaking hilarious to destroy this game which already is destroyed by Jagex wonderfull update's

I support this :D !!

As much as this goes against the SRL moto, I'm all for it

Jagex can just do a roll back anyways

crap. my account is in there :(

good thing i can prepare now :D

From: Awkwardsaw
crap. my account is in there :(

good thing i can prepare now :D

Bank all your items with a bank pin, stay logged in, change your pass to like -05u8aFbz7n48t2Z

should be good.

From: IceFire908
Bank all your items with a bank pin, stay logged in, change your pass to like -05u8aFbz7n48t2Z

should be good.

also, puting money in kingdom, rest in my coustume room. the script says it only checks the bank :D

Takes 7 days to set a pin, thanks to Jagex's anti-security. I'm not going anywhere 'till about 10 so I'll just leave on a script that should be able to run for 5 hours since I don't want to lose my 70m or so :< (just in case :p)

There's a bullzeye107 and a bullzeye2448, but no bullzeye95 x)

From: bullzeye95
There's a bullzeye107 and a bullzeye2448, but no bullzeye95 x)

and there are about 3 A(w)kwardsaws. ;)

God damn. This may be as close to being a part of history as I'll ever get.

Here, everyone that is paranoid and doesn't think using a bankpin/ really complicated pass/ staying logged in is too much trouble.

Run this script http://www.villavu.com/forum/showthread.php?t=53870

He can't hack you if you're already logged in.

My lower account is on it, but none of my others, nor is my friends 123 (thankfully) on it.

~Sand

From: IceFire908
Here, everyone that is paranoid and doesn't think using a bankpin/ really complicated pass/ staying logged in is too much trouble.

Run this script http://www.villavu.com/forum/showthread.php?t=53870

He can't hack you if you're already logged in.

Great, now everyone just ends up banned instead :f: <- was a joke.

From: N1ke!
Great, now everyone just ends up banned instead :f: <- was a joke.

so?/ saw white yea lol

LOL
my accounts aren't in there, but a bunch of people i knows are in there XD
i say go for it lmao i want to see this happen

Cousins accounts in there D:

I call bullshit on this. Looks like an attempt to get people to click your links to sharecash. Nice multi-forum scam attempt. Kudos.

From: Bebe
I call bullshit on this. Looks like an attempt to get people to click your links to sharecash. Nice multi-forum scam attempt. Kudos.

Dunno, that proxy list is pretty legit, so is the source/ player list.

none of mine are, but zezima is in there ;) nice

From: jimmy_mac
none of mine are, but zezima is in there ;) nice

Lol missed that.

None of mine(although I dunno my army names) :(. I wanted to be in. Sounds funny. And what about losing some pixel?

LOL ZEZIMA!

2 of my best friend is on that list:(

Wow this blows. How unlucky am I? None of my relatives high accounts are on there and neither are my friends high accounts are. But oh gawd, my account, the lowest level out of anyone I know who plays RS, is on their. With loads and loads of Holiday items and all random items. Hopefully Jagex will do something. :(

About four level 3's of mine are on there, that I've never told anyone of. Lol.

Meh, i don't really care. I hope it goes through :p

Scam to get idiots to click their sharecash links >_>

Fake "tmz" link, etc.

I know this kid, he isn't capable of shit. He's the worst skiddie ever.

Also, none of the usernames from all my armys are on it.

Also, he has a list of webproxies. LOL. Java won't work over them, nor would HTTPS logins for RuneScape.

"Zytex" is there! :(
not my acc so why should I care? :D
Lol, Widget's acc is there :D
OH YAY! He's gonna hack "God"! A-w-e-s-o-m-e!

Oh well, I only have 10 mil anyways. How will his bot find the bank if I am in a random?

go to lava maze in wildy with a knife/bronze scimmy, go to the section where 2 webs are beside each other and there are no monster, after you get to that place, drop your weapon/knife.
Done:)

From: mormonman
Oh well, I only have 10 mil anyways. How will his bot find the bank if I am in a random?

I think it'll only change ur pass

A majority of my friends have quite 1 year+ ago, none of them are on the list, so is my pures which hasn't logged in in 1year+.


Prolly fake or the biggest scare of video game history.

change username? that should work haha.

but log in is still original
btw
online version
http://data.fuskbugg.se/skalman01/Runescape_Username_List_1_000_000.txt

From: Main_Ftw
but log in is still original
btw
online version
http://data.fuskbugg.se/skalman01/Runescape_Username_List_1_000_000.txt

wait so i still would log in with my original username? i haven't ever done it haha.

lol you changed your name and never played?

From: Main_Ftw
lol you changed your name and never played?

i didn't change it yet.

From: Main_Ftw
go to lava maze in wildy with a knife/bronze scimmy, go to the section where 2 webs are beside each other and there are no monster, after you get to that place, drop your weapon/knife.
Done:)

Home tele? gf :p

From: bionicle1800
Home tele? gf :p

too deep in wildy to tele

From: mormonman
too deep in wildy to tele

ah touche

Only thing I can think of, is he leeched these off a highscore list >_>

My entire army isn't on there.

what about dans the man's lvl3s?

From: mormonman
too deep in wildy to tele

Wait, how do you get out then? :<

From: Widget
Wait, how do you get out then? :<

login to pvp world people will kill you for fun.

non of my acc's are on their and i have about 17 that i can remember

Edit: Has any1 else noticed some of the names that are on this list are wrote out twice …

I just found out there are 2 different lists

this
http://data.fuskbugg.se/skalman01/Runescape_Username_List_1_000_000.txt
!=
the one the kid posted on our forum.

Why has nobody else (other than Harry) pointed out the flaw in the "proxy list". Those are a list of web proxies that cannot support runescape's javaclient and will not mask your IP if used.
Sounds like a big hoax but I would love it to happen for real.

He is probably trying to scare teh crap out of every one and get a award for him self.

From: Main_Ftw
what about dans the man's lvl3s?

Yerr!!! What about my level 3's???

From: Widget
Wait, how do you get out then? :<

have someone bring you a knife.

Runescape 2 Pro, if you read this, your account is on there! I hope you read this.

[QUOTE=Camaro';670919]Runescape 2 Pro, if you read this, your account is on there! I hope you read this.[/QUOTE]

It wouldn't be the first time he has gotten hacked.

Mine is on there :3

i got 1 account in there which is banned so gg for his bot.
my friends account who doesnt play anymore

Hah I don't have any of mine, my bros or my friends accounts in there :D:D:D:D:D Not Even my army accounts xD And I don't think he can do it…If he fails I will prolly die laughing at him :p And if he does….LULZ @ Jagex :p

Edit: Haha he is going to hack God lulz!!!!

This would be amazing if this happened. I highly doubt is for reason that have already been mentioned. 2 of my accounts are on there. I could care less. If he does this, /win!

About 30 of my accounts are in there…

Don't think its gonna happen… Thrill :).

If it really happens I'm going to ROFL so hard, it'll will definitely be one of the top things of my year! Also, as the post on that forum says Just Have A Bank Pin And You Are Safe. So everyone bank pin up your account if you dont have one, and your fine (apparently).

my brother's filthy rich acc is in there, also peeps like Forsakenmage and Lady Heinous (mods), along with other filthy rich guys like Sxq Power and Xecer

From: YoHoJo
If it really happens I'm going to ROFL so hard, it'll will definitely be one of the top things of my year! Also, as the post on that forum says Just Have A Bank Pin And You Are Safe. So everyone bank pin up your account if you dont have one, and your fine (apparently).

Edit: Making new pin takes 7 days to get activated never mind. :p. Also, I think its BS not possible

My brother set a pin after being hacked by a nub (he dropped void, lol! not 150m cash.) so he's safe.

dam i aint on there, but my lv 130 freind is haha.

TBH im guessing he had a bot running just collecting everyones names.

Makes me wonder who "Souhtern" is ?!?!?!? and this really pisses me off from following last link…


http://sharecash.org/caught.php

You are currently attempting to download a file fraudulently.

This is your 1st attempt trying to cheat the system. If you hit 2 attempts your IP address will be permanently banned.

As mentioned, I think this is just an attempt at Click for Cash scam referrals, can anybody validate seeing this on any other sites ? If it wasn't for the fact that I have a few accounts on the list, I would say just IP ban Southern and be done with it, but out of curiosity, We'll see what happens by the end of the day….

I don't think it's a fraud… It's been upped elsewhere as well!

Dans the man, are your lvl 3s ranked?

i dont care if he hack me and drop 20mil jagex will have to give me new 20mil its their fault

They will never give out stuff ;) JaGeX r pricks get used to it.

Jagex gives out free members quite often when they screw up.

From: Main_Ftw
Jagex gives out free members quite often when they screw up.

Well I got a free thirty days because of my 'loyalty' to the game :/.
It was after I bought a three month membership though.

And they've gave out 4 unlimited membership to thoses 4 noobs that have youtube account and sony vegas:duh: Except kk comics

From: mormonman
It wouldn't be the first time he has gotten hacked.

So, it shouldn't happen again, and he plays legit too. :(

From: RAM
Makes me wonder who "Souhtern" is ?!?!?!? and this really pisses me off from following last link…


http://sharecash.org/caught.php

As mentioned, I think this is just an attempt at Click for Cash scam referrals, can anybody validate seeing this on any other sites ? If it wasn't for the fact that I have a few accounts on the list, I would say just IP ban Southern and be done with it, but out of curiosity, We'll see what happens by the end of the day….

Did you check the "Full Story" link he gave? I'm not verifying anything, but it's there.

stupid noob with 1post

Just the nick "MarshviperX" says alot, not to mention the poorly written description of this "legendary hacker" (just calling himself that makes the guy sound retarded). Plus, spamming some Click for Cash links all over random forums tops the whole thing, not to mention that a "legendary hacker" that has gained access and found an exploit in "the Runescape login script" doesn't even know how proxies work (which means he'll most likely be tracked down in no time, if he already hasn't been, assuming Jagex even gives a crap about some incompetent wannabe h4x0rZ internet scaremongering).

E: If this for some odd reason would actually happen it'd be awesome.. But as of what I've gathered by now it seems that the guy is just the average 13-year old daydreamer wannabe spouting random nonsense that either doesn't mean anything or he doesn't even understand and who's biggest "h4xxx0rr" accomplishment is writing batch forkbombs.

I have my fingers crossed though. Godspeed to "MarshviperX".

My main is on the list :(

Lmfao? zezima haha

From: GoF
doesn't even know how proxies work (which means he'll most likely be tracked down in no time, if he already hasn't been, assuming Jagex even gives a crap about some incompetent wannabe h4x0rZ internet scaremongering).

Never heard of anonymouse surfing ?? ussing this tool's they only can confirm it when they check your computer end to check your computer they need to know who you are :D

I hope this happens, I really do.

From: MylesMadness
I hope this happens, I really do.

Yea, cause then while jagex is trying to roll back, we can catch up :p

Ok first off this guys is just trying to gain some recognition as a "1337 Hax0r" and I doubt he will do anything. I can prove this in a couple simple points,

First off he is bullshitting the fact that he will get into the Guinness Book of World Records because no one will be able to verify he did it, and if someone were to verify it he would be in jail for hacking something that belongs to Jagex. That is just one flaw in his story.

The second flaw I found is that he even announced it. If he found a huge vulnerability in the java script plugin he would not have announced it and risked Jagex getting it patched.

Therefore with solid evidence I conclude nothing is going to happen, he is just trying to come off as a "1337 hacker" but he cant really do anything at all. So do not worry he is just trying to get attention because his parents beat him and won't give him any attention at all.

From: Town
Did you check the "Full Story" link he gave? I'm not verifying anything, but it's there.

Yeah, Some…

Post #633

JACK

It's not going to happen. It never was. It never will.

Announcing something like this means JaGeX can patch it before hand.

Here is a few technical reasons why it wont happen to help the nerds understand…

Those 1million account names are from a leaked high scores list about 2 years ago. Several of those accounts don't show up anymore because they are banned. There are duplicates (Zezima three times for example).

The proxy list are web based HTTP proxies. These can't be used in Java because you need full control over the proxy server you are using. IP, port etc. Maybe even an account. These arent real proxies people use to circumvent bans on IRC, Vent etc.

Logging into 1,000,000 accounts on New Years Eve using 4000 slow, laggy HTTP proxies. Ya right. The amount of bandwidth he would recieve would be incredible even if his network/ISP supported multicasting. - providing he could even manage to connect that is.


Who ever created the hoax, enjoy your rapidshit/speedyshare points.

You lot just got trolled.

about sums it up….

I'm on there, but I agree with Harry, RAM, and others. I don't think it will go through. I'd love to see it go through though, even if I lose my main, who has really good stats and 40m. I don't really care about the account anymore. And I lol'd at the book of world records part of the story.

EDIT: If you are scared you're going to lose your account for some reason, register your e-mail to your account.

From: RAM
Yeah, Some…

Post #633





about sums it up….

from a url I posted in a different thread earlier :p

http://www.villavu.com/forum/showpost.php?p=671168&postcount=23

Anybody know a time zone, because I believe it is in SUB 10 hours?

I just wanna watch it, if it does happen.

I used a auto loggin script for me + my good friends accounts, all of their pass has been changed and they've been login since noon est.

Nice
I've been dreaming of this day.
Exept my dads account is on there =(
Will he be safe if he is online at 12?

From: crezzur
Never heard of anonymouse surfing ?? ussing this tool's they only can confirm it when they check your computer end to check your computer they need to know who you are :D

Do you not know how HTTP proxies work?

From: Ejjman1
Anybody know a time zone, because I believe it is in SUB 10 hours?

I just wanna watch it, if it does happen.

If he's American, as idiots tend to be, bet on EST.

Jeez, i just noticed this cant be real..

Reasons

-That TMZ pic on the first post, is clearly notepad. If you notice on the left side it has a green windows vista, or windows 7 theme. Meaning it was written in notepad.

-The cursor is blinking on the word 'MarshviperX', meaning it was written in notepad.


Case closed :)

The proxy list is gone on pastebin

From: lordsaturn
The proxy list is gone on pastebin

I have it saved, if anyone wants

[QUOTE=Camaro';671265]Jeez, i just noticed this cant be real..

Reasons

-That TMZ pic on the first post, is clearly notepad. If you notice on the left side it has a green windows vista, or windows 7 theme. Meaning it was written in notepad.

-The cursor is blinking on the word 'MarshviperX', meaning it was written in notepad.


Case closed :)

It's obvious that it was written in notepad. What's your point?

From: bullzeye95
It's obvious that it was written in notepad. What's your point?

this is what that pic is supposedly, according to the guy reporting all this stuff

UPDATE4: Less than an hour ago MarshviperX wrote an open letter on his temporary real-time blog about the hacking. I missed it since it was deleted in under 5 mins but some people were able to screenshot it:

^

wrote an open letter on his temporary real-time blog about the hacking

^

they're claiming he wrote this on his blog, but that's notepad

[QUOTE=Camaro';671284]this is what that pic is supposedly, according to the guy reporting all this stuff



^



^

they're claiming he wrote this on his blog, but that's notepad

Called Copy and paste.

From: BobboHobbo
Called Copy and paste.

Your saying the guy who took the screeny, copyed and pasted the info to notepad for no reason?

Whats the purpose of doing that?

Why not just take a screeny of the blog..?

EPIC FAIL:) Nothing happened.

From: Main_Ftw
EPIC FAIL:) Nothing happened.

orly?:p

See another flaw. 12 midnight? WHO's TIME. its 10:34 here. Everyone was thinking there own time. For All I know, its way past midnight where this "hacker" lives.

Maybe the morning I wake up, rs will become a pornography site:f:

From: Main_Ftw
Maybe the morning I wake up, rs will become a pornography site:f:

You made my minute:) Very funny

Hahaha failed. He will come in the guiness book alright…It will be as the worlds dumbest hacker (if he really is one that is…) :D

So was he telling the truth ? I dont know what happened .. my account wasn't in the list.

where I live, it is now 8:34 AM, I live on the east coast of the USA, my main account was on the list, I logged it out last night with a sara sword and 11M cash in the inventory, still all there. Nothing happened, pretty sure it was all just a big scare.

Lesson learned, Tell the next person who says shit like this "gtfo".

It happened.

From: Cigue
It happened.

Source?

From: IceFire908
Source?

From: Cigue

Owned.


But does that mean a significant portion of that list was?

Apparently the "hacker" himself says this was a hoax. so WHAT THE *bleep* HAPPENED TO MY ACCOUNT ?

It's seven years old brah… I grew attached to it :'(

OMG, mine's inside O_o… i'll change everythin asap :duh:

just to let you know he profited from it i can't remember where but he uploaded the list to rapid share or maga upload one of those sites and he got points every time it was downloaded so really he did get alot from it…

From: Cigue
Apparently the "hacker" himself says this was a hoax. so WHAT THE *bleep* HAPPENED TO MY ACCOUNT ?

It's seven years old brah… I grew attached to it :'(

7 years? you should be able to recover it.

Owner response

From: Cigue
It happened.

Told you guys he is just a skid.

*Watch as DI fall to rank number infinity on runehead*

No! I wanted this to happen! :(
It.. was all.. a hoax..

lets make srl famous lets say we going to take over runescape then everyone will come to this site!

-.- fail.

From: BobboHobbo
lets make srl famous lets say we going to take over runescape then everyone will come to this site!

-.- fail.

That might actually work, although it's a bad idea.

Here's my update… I recovered my account, but when I got to use it all the items on it were sold, and I had 29M cash in my bank (probably the combined value of the stuff that got sold).

Lotsa quest items thrown away :(

FYI, it's the first time I get my account "borrowed", and all clues point to someone from SRL. Keep your accounts safe!

From: Cigue
Here's my update… I recovered my account, but when I got to use it all the items on it were sold, and I had 29M cash in my bank (probably the combined value of the stuff that got sold).

Lotsa quest items thrown away :(

FYI, it's the first time I get my account "borrowed", and all clues point to someone from SRL. Keep your accounts safe!

Please tell me you got the IP..

From: Nava2
Please tell me you got the IP..

Whoops… Damn…

Once I logged back in, is there anyway that I can see it again?

Nope..

Actually the 'IP' runescape tells you doesn't really help much here at SRL, searching that up in the mod section doesn't bring up any results, because its in a weird format. Just be happy you recovered your account successfully, good job

Close the thread?

PM Jagex lol

ok we just got owned :)

From: YoHoJo
Actually the 'IP' runescape tells you doesn't really help much here at SRL, searching that up in the mod section doesn't bring up any results, because its in a weird format. Just be happy you recovered your account successfully, good job

Actually Wizzup can run it through the database and show any matches.

FYI, his 1 million accounts list comes from a post on RS unlocked in the cracker section. So if anyone on the list was hacked, it's likely someone is just using this list with a common password cracker and you weren't using a secure password.

My password was 9 letters and 3 numbers long, random word with random number, not iloveyou123 or anything like that - and since it happened on NYE, less than 6 hours after I last logged out, I find brute force cracking next to impossible.

Thank you for info, though.

From: Cigue
My password was 9 letters and 3 numbers long, random word with random number, not iloveyou123 or anything like that - and since it happened on NYE, less than 6 hours after I last logged out, I find brute force cracking next to impossible.

Thank you for info, though.

Maybe it was your friends playing a joke on you :p?

wow, he got his attention.

From: BobboHobbo
Maybe it was your friends playing a joke on you :p?

lol bro I wouldn't even tell my mom my pw :p

Anyway, since it's solved, everything's well. I'm even richer now ingame because whoever hacked me sold things I'd never got around to sell.

From: YoHoJo
Actually the 'IP' runescape tells you doesn't really help much here at SRL, searching that up in the mod section doesn't bring up any results, because its in a weird format. Just be happy you recovered your account successfully, good job

RuneScape gives a reverse-DNS of the IP. All you need to do is do a forward-DNS on it…

From: Harry
RuneScape gives a reverse-DNS of the IP. All you need to do is do a forward-DNS on it…

Well sorry Sargent Mc Nerdy Pants! I didn't know!

From: YoHoJo
Well sorry Sargent Mc Nerdy Pants! I didn't know!

OhmygodthanksIloveyouforthat.

None of my accounts was hacked, only Cigue ?

Close this haox pl0x

From: Main_Ftw
Close this haox pl0x

Why? A thread should only be closed if there is any insulting/inappropriate posts in it.. I think this thread is a great discussing thread actually.

Please give me one reason to why you would want it closed?

From: Zyt3x
Why? A thread should only be closed if there is any insulting/inappropriate posts in it.. I think this thread is a great discussing thread actually.

Please give me one reason to why you would want it closed?

Because its over?

No need to close, but keep 'er on topic ;)

From: mormonman
Because its over?

Not a good reason…

Lets flame the hoaxer then :f:

it had my main and all my army on this lol i really wanted 2 see it happen. coodnt care less if main got hacked i woulda loved a good laugh after watching the fireworks