+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: Backdoor in popular subscription based streaming website (/showthread.php?tid=5337129)
Backdoor in popular subscription based streaming website - NootNoot - Jul 13, 2016
So as the title explains i have a backdoor on one of the most popular paid subscription websites, now what?
Many attempts at rooting the server have failed but i have obtained the full database of emails:hash/salt,
i'm not really in the market of leaking this sort of thing but if i could make some money from the website
owner in trade for privacy that would be nice.
So i ask, what do you guy normally do when faced with this situation? Just leave it and move on or push for profit?
Thanks for your advice. 🤝
* - -Elusive- - Jul 13, 2016
Very nice.
I would see if theres a market for selling accounts of the site and you can just generate paid accounts, if you have access to the database you can just create premium accounts.
In regards to the database, I would only sell that if the first method fails. Make sure to take a full sql back of all the user data, its more valuable that way.
* - NootNoot - Jul 13, 2016
(Jul 13, 2016 08:32 AM)-Elusive- Wrote: Very nice.
I would see if theres a market for selling accounts of the site and you can just generate paid accounts, if you have access to the database you can just create premium accounts.
In regards to the database, I would only sell that if the first method fails. Make sure to take a full sql back of all the user data, its more valuable that way.
The problem is the database is taken from a separate forum which although holds all the same user details is not linked to the website, this leaves me with a database full of their users logins that work but if i edit them it has no affect on the actual website.
The accounts on the website are very valuable and i think i'm going to do some brainstorming to try progress further with obtaining the admins login data for the actual website.
* - -Elusive- - Jul 13, 2016
Ah I see, well if you need any help just PM me your xmpp or whatever :)
Don't forget to check out the server you are already on to see if there's anything that can help you jump to that other server.
* - MyNamesV - Jul 13, 2016
I'm having troubles with sql injecting on some php site. I'm using Kali Linux light with downloaded package tools to exploit.
Can you please help? Message or skype: Sprinxo.
Thanks
* - Colonel Panic - Jul 13, 2016
Or you could not risk it and tell them you've found the backdoor and ask for some kind of monetary reward, maybe they have a bug bounty scheme.
* - Dave from the lawyer firm - Jul 14, 2016
very nice OP, very nice :)
* - Walt Disney™ - Jul 14, 2016
Tell them. They may even pay you for letting them know.
If it's one of the biggest, I'm sure there would be legal trouble if you did something malicious. If any of the sites crawled and saw this thread then checked for attacks, they'd link it directly back to you. Be careful.
* - mzaboss - Jul 14, 2016
Ask for a reward. Be nice, people will be nice to you back. cheers.
* - NootNoot - Jul 14, 2016
Sorry i forgot to add it was an illegal steaming website, i'm going to contact the owner tonight and go from there, will post an update for anyone interested.
* - D0ppler - Jul 14, 2016
Oh shit things bout to get real. I hope things go well Noot. I dont see you getting into any trouble if its an illegal site. GL man.