[DerJager]

This is all a rumor imho until I see direct evidence of compromised accounts.  Personally finding it hard to believe.

Passwords are not stored in the cookies.  If a browser exploit existed it would have to steal it from the AUTOFILL.
https://chromereleases.googleblog.com/20...3.html?m=1

So maybe that's what's going on.

Maybe MyBB allows for malformed signature that's allowing code execution into the browser?

I really think this could be a hoax.  Some of what is being stated doesn't make much sense.

Heres a snippet from one user within the dump
Cencored sensitive data with XXXXXXX


Some more examples if you still dont believe it
https://hackforums.net/member.php | svenikolai2 | 3eU2iq97uNVehVf
https://hackforums.net/member.php | safwan mazari | safwan321safwanS

Create a dummy user in the db with those passwords with your encryption and wathc the hash match

Accounts have been banned by eagle

[Aeowulf]

Hah, thanks. Actually thought someone tried to jack my account.

[Mr. Robot]

asdasd

Maybe PM Omni instead of posting it on the thread. It'd be a good start - and instead of waiting for his thread, contact him when you find information.

[DerJager]

Maybe PM Omni instead of posting it on the thread. It'd be a good start - and instead of waiting for his thread, contact him when you find information.

Tell me the leak and ill make sure that he doesnt realease this data
Once i know who leaked info to you i will guarnatee this data breach never happens and the exploit gets patched

The balls in your hands now

[Mr. Robot]

Tell me the leak and ill make sure that he doesnt realease this data
Once i know who leaked info to you i will guarnatee this data breach never happens and the exploit gets patched

The balls in your hands now

I have DMd you in regards to this. Your typing however seems erratic and accusatory. "doesn't" "release" "guarantee"

[DerJager]

I have DMd you in regards to this. Your typing however seems erratic and accusatory. "doesn't" "release" "guarantee"

my guy im just high as a kite right now. The leak isnt public and wont be, as far as im aware im the only one with contact with the 0day discoverer if thats even a word. The second i told him he was like who knew and spoke.

---

Anyway there is no real reason for concern clearing the cookies was a good idea, should be done again once this exploit gets patched so it cant be repeated

[Mr. Robot]

my guy im just high as a kite right now. The leak isnt public and wont be, as far as im aware im the only one with contact with the 0day discoverer if thats even a word. The second i told him he was like who knew and spoke.

I'm sure Omni is more than capable of keeping up with the happenings online however if someone were to have leaked it to protect the interests of HF - good on them, I support their decision. From the list of users you sent me - if it happened to be anyone on that list I can note 5 people who wouldn't have done it. The rest all would have - that doesn't mean they did -

People love HF and want to protect the users and interests. The fact you didn't report it tells us a lot about you.

[Leroy Jethro Gibbs]

I'm sure Omni is more than capable of keeping up with the happenings online however if someone were to have leaked it to protect the interests of HF - good on them, I support their decision. From the list of users you sent me - if it happened to be anyone on that list I can note 5 people who wouldn't have done it. The rest all would have - that doesn't mean they did -

People love HF and want to protect the users and interests. The fact you didn't report it tells us a lot about you.

I'mma guess the 0day doesn't affect us at all?

[DerJager]

I'm sure Omni is more than capable of keeping up with the happenings online however if someone were to have leaked it to protect the interests of HF - good on them, I support their decision. From the list of users you sent me - if it happened to be anyone on that list I can note 5 people who wouldn't have done it. The rest all would have - that doesn't mean they did -

People love HF and want to protect the users and interests. The fact you didn't report it tells us a lot about you.

1. Reporting it creates fear and unnecasary actions. Imagine how many users just lost access to their account.
2. I know the dump is going to be leaked, it was discovered and tested then sent of as a exploit to Zerodium.

[Maskin]

For a second I thought that I did something to cause the shutdown when I changed the bytes slot reels px positions to get 3 hearts cause I’ve never seen how it looks 🤣

[DerJager]

I'mma guess the 0day doesn't affect us at all?

Well i know it hasnt been used on HF. It has been used on competitor sites that share a lot of the same users. But the 0day has been sent to zerodium and shouldnt be used ever again.

[Mr. Robot]

Tell me the leak and ill make sure that he doesnt realease this data

I know the dump is going to be leaked

Right. And reporting it to Omniscient so he can protect his interests? Every single fucking time I have ever found a 0day I will secure those I wish to protect as well as clients for websites I have built in the past while at the same time reporting it.
I get that you want your big payout - but you actively used it to exploit a community and you thought that was OK.

I DO NOT stand by you or your associates decisions in exploitation - proof of concept only, never use for malicious purposes.

You say it has not been used on HF yet we know users share a pathway between communities - for better or worse. This in turn hurts the community.
You never had to disclose what it was to Omniscient - however informing him privately that such a thing was in the works would show you actually cared for the community.
>> Instead you accuse me of having insider information - in which I wish I had. To then report it to Omniscient.

[DerJager]

Right. And reporting it to Omniscient so he can protect his interests? Every single fucking time I have ever found a 0day I will secure those I wish to protect as well as clients for websites I have built in the past while at the same time reporting it.
I get that you want your big payout - but you actively used it to exploit a community and you thought that was OK.

I DO NOT stand by you or your associates decisions in exploitation - proof of concept only, never use for malicious purposes.

1. You say i dumped it which is funny.
2. Sharing the dump would be entirely illegal especially as its for a bug bounty

Anyway im done repliying if omni ever needs anything he can pm me other than that.

also this is very silly to say "but you actively used it to exploit a community and you thought that was OK. "

To discover an exploit you need a target right? Wether white hat or black hat you need a target. You cant know if a exploit is valid if you do not test it correct?
it was sent to zerodium 10 mins after being discovered i am waiting for my 30% payout from it the rest goes to the other guy.

Its like me doing a remote jailbreak for iphone which is illegal, but Zerodium pay 2mil for it which all of a sudden makes it legal and clean money.

---

Right. And reporting it to Omniscient so he can protect his interests? Every single fucking time I have ever found a 0day I will secure those I wish to protect as well as clients for websites I have built in the past while at the same time reporting it.
I get that you want your big payout - but you actively used it to exploit a community and you thought that was OK.

I DO NOT stand by you or your associates decisions in exploitation - proof of concept only, never use for malicious purposes.

You say it has not been used on HF yet we know users share a pathway between communities - for better or worse. This in turn hurts the community.
You never had to disclose what it was to Omniscient - however informing him privately that such a thing was in the works would show you actually cared for the community.
>> Instead you accuse me of having insider information - in which I wish I had. To then report it to Omniscient.

You are getting way too defensive.

wouldnt it be safe to say, you did have some info about the 0day that was told to you before omni reset the cookies. and i know i didnt tell and theres numerous discord messages saying you did. Anyway im out safe one boys take it easy

[Mr. Robot]

1. You say i dumped it which is funny.
2. Sharing the dump would be entirely illegal especially as its for a bug bounty

Anyway im done repliying if omni ever needs anything he can pm me other than that.

also this is very silly to say "but you actively used it to exploit a community and you thought that was OK. "

To discover an exploit you need a target right? Wether white hat or black hat you need a target. You cant know if a exploit is valid if you do not test it correct?
it was sent to zerodium 10 mins after being discovered i am waiting for my 30% payout from it the rest goes to the other guy.

Its like me doing a remote jailbreak for iphone which is illegal, but Zerodium pay 2mil for it which all of a sudden makes it legal and clean money.

-"To discover an exploit you need a target right"
With the targets permission or you setup a test server with the same conditions.

This is the single most basic thing when it comes to pentesting.

>> Not only that but there's a huge difference in the right scenarios of gaining access to a database and dumping a database. Unauthorized access is unauthorized access -
When you have access to someones backend - you don't keep fiddling, you've already bypassed what you are suppose to.

[Mr. Robot]

You are getting way too defensive.

wouldnt it be safe to say, you did have some info about the 0day that was told to you before omni reset the cookies. and i know i didnt tell and theres numerous discord messages saying you did. Anyway im out safe one boys take it easy

Nobody PMd me regarding any of this - check my posts from the last 24 hours or whenever the 0day was found.
I don't care what the discord messages say, I don't know if someone contacted Omni or he found out on his own - if someone did contact him, you have a leak in your chat which i'm thankful for - not a leak to me, but to Omni or someone else who then contacted Omni.
As far as the user Ahri accusing me of posting about the 0day - that's 100% a lie. And as such, it looks as though they are pointing the blame away from themselves.