Bug Detected (Username History)

Bug Detected (Username History) - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hack Forums Official Information (https://hackforums.net/forumdisplay.php?fid=1)
+--- Forum: Site News (https://hackforums.net/forumdisplay.php?fid=2)
+--- Thread: Bug Detected (Username History) (/showthread.php?tid=6233162)

Bug Detected (Username History) - Game - Feb 12, 2023

So I was sent a URL to look at someone’s username history and realised I was viewing the page through the discord browser and was not signed in.

To test, open a new private browsing window and paste the following link into the web address bar.

Using Extras>Username History (https://hackforums.net/uhsearch.php) I am greeted with “This is an Ub3r only feature.” as I am L33T but I can still obtain the results using the link below.

https://hackforums.net/misc.php?action=username_history&uhuid=3539763 Used my own UID as an example.

Tl;dr - Username history(Ub3r only feature) can be viewed by anyone, without the need to be registered/logged in. Just obtain UID of target, then you can see their username history.

FAO: Omniscient

RE: Possible bug? (Username History) - Nostre - Feb 12, 2023

Nice find. I’m sure once Omni sees this, it’ll be fixed.

RE: Possible bug? (Username History) - Game - Feb 12, 2023

(Feb 12, 2023 05:39 PM)Genuine Wrote: Nice find. I’m sure once Omni sees this, it’ll be fixed.

Thank you, hopefully it’s a simple fix. (Should be).

Just doing what I can to keep the community safe.

RE: Bug Detected (Username History) - Cooligan - Feb 13, 2023

Can confirm this, just tested it myself:

Spoiler (Click to View)
Spoiler (Click to View)

RE: Bug Detected (Username History) - Cooligan - Feb 13, 2023

(Feb 13, 2023 04:54 AM)m0hx Wrote: U can also see who posted in a thread without logging in:
https://hackforums.net/misc.php?action=whoposted&tid=6233162

replace tid=ThreadID for any thread.

If you open this page while logged in you get this lol:
Spoiler (Click to View)
edit: Turns out it gives you the same page whether you're logged in or not:
Spoiler (Click to View)

RE: Bug Detected (Username History) - Cooligan - Feb 13, 2023

(Feb 13, 2023 07:19 AM)m0hx Wrote: even if ur logged out :D try it in incoginto mode.

Yeah check my post again, I updated it with a screenshot from a Brave private window.

RE: Bug Detected (Username History) - Cooligan - Feb 13, 2023

(Feb 13, 2023 07:26 AM)m0hx Wrote: nice. Wait I'll post some more.. I'll update my post :3
edit: updated!

Oh damn! Well shit this is gonna be fun lmao 😈

Nah I'm genuinely curious though what I'm able to find, will definitely report it back here as well.
I love snooping for little fixes like this on HF, always have.

I remember when we used to have a bunch of little easter eggs onsite, a bunch have since been deleted though.

RE: Bug Detected (Username History) - Game - Feb 13, 2023

(Feb 13, 2023 04:54 AM)m0hx Wrote: 1. Who Posted - U can also see who posted in a thread without logging in:

replace tid=ThreadID for any thread.

https://hackforums.net/misc.php?action=whoposted&tid=6233162

2. Get Users - Search for users in the query (just like when u search for user to invite/convo somewhere)

https://hackforums.net/xmlhttp.php?action=get_users&query=m0h

3. HF Complix Password Check - I think its used when u signup.

Good Password: https://hackforums.net/xmlhttp.php?action=complex_password&password=myHFPassword123
Bad Password: https://hackforums.net/xmlhttp.php?action=complex_password&password=qwerty

4. Username Availablilty - Check if the username is availble to register/change to.
- First you need to find your "Post_Key" here are the steps (even when logged out, u can get Post_key as a guest when you load HF, each time you close ur browser or close/open new incoginito window ull have new Post_Key to use.

Here's how to get the Post_Key value:
1. Open new HF page (either logged in or incoginto)
2. Wait for it to verify ur human/captcha thingy.
3. Right-Click anywhere -> View Page Source -> and search for: Post_Key

for example this is my Post_Key value as show in the picture above: xxxxxxc226a87610d675e69e201969bd

Now you can paste the Post_Key value in this URL and check for username availablity:

POSTKEY = ur post key.
USERNAME = username to check if available or not.

Code
https://hackforums.net/xmlhttp.php?action=username_availability&my_post_key=POSTKEY&username=USERNAME

https://hackforums.net/xmlhttp.php?action=username_availability&my_post_key=xxxxxxc226a87610d675e69e201969bd&username=m0hx

returns: "m0hx is already registered by another member" :D

Good stuff, was just about to add these to the thread but you already did.

There’s actually quite a few functions accessible outside of the user scope.

RE: Bug Detected (Username History) - Omniscient - Feb 13, 2023

None of these are a concern.

Username History search is not the same as viewing a users specific username history.

The rest are just odd pages which don't require a login to get data. All harmless.

RE: Bug Detected (Username History) - Game - Feb 13, 2023

(Feb 13, 2023 12:50 PM)Omniscient Wrote: None of these are a concern.

Username History search is not the same as viewing a users specific username history.

The rest are just odd pages which don't require a login to get data. All harmless.

Thank you for confirming. I wasn’t sure so thought to make you aware.