[device]

Interested in searching exploits in HF games. Am I allowed to (locally) and report them by PM to an admin ?

What would you consider an exploit in the slots game ?

[Digital]

Yes, if you find any. Please be aware that if you trigger something it will result in a IP ban.
Omni's HF bug bounty thread: https://hackforums.net/showthread.php?tid=5259373

[Dotexe]

Yes, if you find any. Please be aware that if you trigger something it will result in a IP ban.
Omni's HF bug bounty thread: https://hackforums.net/showthread.php?tid=5259373

That's where the confusing part comes. I will obviously trigger it when im onto something. Can someone clarify it for me ?

[Neeeeeeeeeel.-]

That's where the confusing part comes. I will obviously trigger it when im onto something. Can someone clarify it for me ?

Well, if they have to disable security features for you to find a bug then what's the point?

[QU⚡CKSILVER]

That's where the confusing part comes. I will obviously trigger it when im onto something. Can someone clarify it for me ?

If HF defense systems detect potential exploitation attempts, your IP will be blacklisted. Maybe try your vulnerability research using a different IP than yours, so you don't raise red flags on your own account.

[Prawnster]

That's where the confusing part comes. I will obviously trigger it when im onto something. Can someone clarify it for me ?

I think the only chance of an IP ban is if you are using scanning software and sending too many requests to Hackforums (based off of that thread).
I'm sure if you do get IP banned though, you can use the contact form and explain the situation to Omni that you weren't using scanning software and that you would like to be unbanned and hope he's in a good mood haha

[Dotexe]

Well, if they have to disable security features for you to find a bug then what's the point?

Please read which comment I quoted, I am not saying they should disable the security features, what I am asking is what is the point of me looking at bugs, when If i do find one, i will be most likely already be banned by the system, because I was previously flagged that i ran into some spots.

---

I think the only chance of an IP ban is if you are using scanning software and sending too many requests to Hackforums (based off of that thread).
I'm sure if you do get IP banned though, you can use the contact form and explain the situation to Omni that you weren't using scanning software and that you would like to be unbanned and hope he's in a good mood haha

To be honest, scanning just automates the job, you can hit specific parameter with or without that tool. I don't believe Omni will be fine with whitelist feature, because only certain amount of people will have the possibilites to look for exploits. I'm waiting to see what's his opinion on that matter though.

[ven0m]

Hence, he recommends using the myBB Vanila software to try out first and focus on the custom coded part of Hack forums later.

[device]

I've managed to change some slots parameters such as game speed and betting values but nothing major here.

[Xerotic]

I've managed to change some slots parameters such as game speed and betting values but nothing major here.

Yes, you can programatically send send any "bet" between 1 and 1000.

[device]

Yes, you can programatically send send any "bet" between 1 and 1000.

I guess a copy of the game is happening in the back-end, I can't find when the second dealer's card is dealt though.

[Xerotic]

I guess a copy of the game is happening in the back-end, I can't find when the second dealer's card is dealt though.

In Blackjack, the dealer's hand is revealed after all other players have placed their wagers and it is time to settle the bets.

[device]

In Blackjack, the dealer's hand is revealed after all other players have placed their wagers and it is time to settle the bets.

Yes but in Blackjack the dealer is dealt his cards at the same time as everyone else and then turns his second card once players turns have been played?

In the code I can't find when the dealer is dealt his second card, and if it has a value other than "XX". Not trying to find the value here.
Just asking if in the blackjack client script the dealer is dealt a second card that has a value attributed to it other than "XX", or if that happens on the server side.

Xerotic Mind sharing where "XX" is defined ?

[POLY MATH]

Interested in searching exploits in HF games. Am I allowed to (locally) and report them by PM to an admin ?

What would you consider an exploit in the slots game ?

Hack safely(don't DoS resources, avoid targeting members, etc. common malicious behavior) and report responsibly. You should be fine.
Omni wouldn't be so unreasonable to ban you for hacking the slots game unless you started spreading unlimited wealth and just being malicious...you know right from wrong.

I am not sure what you mean by "locally"? HF Games are "custom"(from what I remember it is built upon some other gaming script) not some plugin that can be added in MyBB.

I haven't looked at it in forever though so everything I am saying could be wrong. I'll probably look at the new features for the API when it drops...that's about it. I have to get OSCP so my focus is on that.


-EDIT

If you are a beginner, I would recommend starting with known vulnerable projects like "Damn Vulnerable Web Application".
Xerotic normally uses safe functions and practices secure coding throughout his SDLC. Def. not for the beginner.

-EDIT

I wonder if any Race Conditions exist within the Black Jack game?...

[device]

ahahaha you changed a field value in a post request... 🤣

---

You think a game will expose all of the logic without a backend?
Are you a UI Dev by chance? 🤐

I did say nothing major lol. Of course not, I like putting things a part and trying to understand their functionning that's all. Yes I work on front end, no need to be an ass though.