+- Hack Forums (https://hackforums.net)
+-- Forum: Hack Forums Official Information (https://hackforums.net/forumdisplay.php?fid=1)
+--- Forum: Site News (https://hackforums.net/forumdisplay.php?fid=2)
+--- Thread: Are we allowed to search for vulns in HF games and report them ? (/showthread.php?tid=6079644)
Pages: Pages
1
2
RE: Are we allowed to search for vulns in HF games and report them ? - Omniscient - May 20, 2020
Quote:I wonder if any Race Conditions exist within the Black Jack game?...
We solved all race conditions on HF with a special custom function. It's implemented in any areas we feel could be exploited to generate Bytes.
Quote:Omni wouldn't be so unreasonable to ban you for hacking the slots game unless you started spreading unlimited wealth and just being malicious...you know right from wrong.
That's usually how it is. If someone wants to report a bug or exploit I am fine with that.
Scanning HF for Vulns with a bot or script is likely going to get your account closed. I review logs very regularly. Normally scans will show up there.
Quote:In the code I can't find when the dealer is dealt his second card, and if it has a value other than "XX". Not trying to find the value here.
Just asking if in the blackjack client script the dealer is dealt a second card that has a value attributed to it other than "XX", or if that happens on the server side.
Xerotic Mind sharing where "XX" is defined ?
It's in the database not shown to the member until the hand is over. It is dealt correctly as in Player->Dealer->P->D. Why would the dealer card be in the JS for you to view as the client? That would be stupid.
RE: Are we allowed to search for vulns in HF games and report them ? - Cooligan - May 21, 2020
(May 19, 2020 08:46 AM)ven0m Wrote: Hence, he recommends using the myBB Vanila software to try out first and focus on the custom coded part of Hack forums later.
This would definitely be the best approach to this if you're not going to directly let Omni know exactly what it is you'll be doing prior to you actually doing it; which is basically impossible seeing you're looking for potential exploits.
RE: Are we allowed to search for vulns in HF games and report them ? - POLY MATH - May 21, 2020
(May 21, 2020 05:38 AM)Cooligan Wrote: This would definitely be the best approach to this if you're not going to directly let Omni know exactly what it is you'll be doing prior to you actually doing it; which is basically impossible seeing you're looking for potential exploits.
Yeah. I must admit that looking for vulnerabilities in MyBB may be more productive but you don’t need to let Omni know your looking for vulnerabilities unless you find one.
Any scanning software like Acunetix, etc. is typical disallowed in any VDP. Directory bruteforcing should be kept to a minimum(compile a custom list) and do a slow scan.
To be frank, I wouldn’t look at BlackJack. The script itself it is built upon looked pretty good. And as for Race Conditions...Omni ended that curiosity haha.
Regardless, OP. My recommendation is the same. Start with known vulnerable projects before attempting to exploit MyBB or custom software on HF. If anything, it will save you a lot of time.
If you are serious then I would look into API V2 when it drops. Xerotic isn’t perfect. He will fudge up eventually lolol...I hope(For my sanity).
I must say, I am impressed with the work they have accomplished from a security engineer perspective. I’ll poke the bear again in a month or so. I’ll get that BlackHat award eventually.
I think I’ve got one reported vulnerability under my sleeve. An open redirect in HF’s new Marketplace Feature..barely worth mentioning.
It’ll all come together though.
P.S. Expand your searches to HF Blogs and other domains/subdomains. You may have more luck there. I’ve yet to do it myself so Good Luck!
-Typing from mobile. I’m not going back to fix grammatical errors. Y’all will figure it out lol
RE: Are we allowed to search for vulns in HF games and report them ? - Athr - May 21, 2020
Try registering on https://knotbb.com or ask Xerotic to get you an account.
Its where HF is developed for the most part.
(May 19, 2020 06:38 PM)xadamxk Wrote: ahahaha you changed a field value in a post request... 🤣
Don't be mean to him, you meanie.
RE: Are we allowed to search for vulns in HF games and report them ? - device - May 22, 2020
(May 21, 2020 10:30 PM)Athr Wrote: Try registering on https://knotbb.com or ask Xerotic to get you an account.
Its where HF is developed for the most part.
Will do, thanks Athr 👍