[YourMom]

I hope this type of request doesn't break the site's rules. I am very desperate to get this working, so it's a chance I am willing to take.

Edit: So I don't know if it breaks the rules. In this forum's subform "Request for Hacking", there is a rules link above that says "1. You cannot offer money for services here. All Marketplace style threads belong under the Marketplace tab. Violators get an automatic 3 day ban." However, that's for that subforum, not this one, so I don't know. I don't even see a "Marketplace" tab anywhere. Anyway, here my request:

I have spent over two weeks trying to debug through thousands of lines of minified and possibly obfuscated Javascript to figure out how an authentication code is generated for a social media site. I need this code in order for my bot to be able to post content to the platform. A forum for hacking seems like the perfect place to start.

You would not need to write any code likely, but just tell me where in the Javascript this is all occurring so that I can rewrite the logic in my own .NET program. It may not be simple, though, because a lot of hashing is occurring with data that I have no idea how the code is acquiring it. Someone of entry-level skill will likely not be able to figure this out.

Edit: I said you wouldn't need to write code, but this may not be entirely correct. I will need you to provide proof that you've figured it out, so you may need to write some quick/dirty code to replicate the hashing and send the request, but that's it. I don't think the hashing is proprietary and uses MD5 at least, so the language you write in may have all the hash algos already.

For anyone who has the proper tools to reverse-engineer JS, this may be an easy ask for you. I don't know how much this would be worth, so you could PM me and we could work out the details and I could give you the URL to the platform.

Here's the entire process:

1. Sign up to the platform. It requires NO information other than a username. There is no verification. After you sign up, you will be given a QR code and a secret phrase, either of which you use to login again in the future.
   


2. Logging in: Somewhere in the code, your credentials are hashed out and stored in your browser's local storage. I don't know where this is occurring, but it is likely needed in the next step
   


3. Now that you're logged in, you can post content, vote on other people's content, etc. This is where I need the bulk of the help. When you vote on someone's content, your browser will send a request like below which I intercepted from Fiddler. That first parameter is what I need to know how to generate, a 580-character-long hex string that is computed from what appears to be a byte array that goes through several stages of hashing. I am having a lot of trouble figuring out where this byte array comes from because my Javascript debugging skills are garbage.
   


4. If you are able to help me out with this, I will likely recruit you again to figure out how to rebuild the requests that are sent when signing up. This will allow me to automate the creation of user accounts.
   

It is highly likely that the JS on this site comes from other open-source code that has been transpiled from TypeScript. If you are able to identify where it is, it might make it easier.

The request that is sent when voting:

{
"parameters": [
"0200*0003b*6db60*01a8f6fff942f6ee2*73a2b33d4e960a492", //this is the auth token (580 characters)
{
"share": "post ID",
"value": "5"
},
"upvoteShare"
],
"method": "sendrawtransactionwithmessage",
"options": {
"node": "node IP address"
},
"state": 1
}

[linkinpork]

Now that you're logged in, you can post content, vote on other people's content, etc. This is where I need the bulk of the help. When you vote on someone's content, your browser will send a request like below which I intercepted from Fiddler. That first parameter is what I need to know how to generate, a 580-character-long hex string that is computed from what appears to be a byte array that goes through several stages of hashing.

Hi,

It's called a session token, made to be as random as needed to make sure what you're trying to do here doesn't succeed. It also expires -- typically on a time limit, after logouts, after profile updates, and after password change.

https://en.wikipedia.org/wiki/Session_ID

Imagine what would happen if one would just be able to guess a person's session token on the fly.

[YourMom]

Hi,

It's called a session token

I got your PM, but the site requires me to have 25 quality posts to reply to it. The platform is pocketnet.

I've been able to successfully pull data that doesn't require authentication such as feeds, user profiles, etc. They're all simple requests that return JSON. It's the actions like voting and posting content that require that long hex string. I can see it being generated in the code as I debug in join.min.js at around line 14074 (search for

Code

.build().toHex()

). The string is assigned to a variable and then later passed along with the request. Also, per your PM, that platform doesn't have "convos" or anything if that's what you meant by "send me a convo". I don't use these style of boards very often if you can't tell.

You'll want to try automating something simple like a vote. Just 5-star some posts or upvote any of the comments beneath them. Have your browser's dev panel open so you can monitor outgoing requests and look for one that resembles what I posted in my OP. It seems that, if the browser can generate it, code can replicate it.

As for your proposed form of payment, I have never used crypto, so I'll need to figure that out. So lets say you offered $1 in btc. Would that equate to 0.000031 Bitcoin? We'll probably have to find a way to discuss that considering my PM limitations here. Going to bed now, so I'll check back later.

[linkinpork]

Also, per your PM, that platform doesn't have "convos" or anything if that's what you meant by "send me a convo".

Hi,

You're overthinking it.

https://hackforums.net/convo.php

Check your notifs.

EDIT: Nevermind. I'll just tell you here.

First of all, pocketnet is hilariously toxic. I feel bad for the devs.

Second, It communicates via websockets through ports 8099,8888,8899, and 9090. Don't expect to reverse it through frontend JS. It will not work. You'll need to see how the API works from the inside.

The URL where the data for posts comes in is https://*:8899/rpc/sendrawtransactionwithmessage . It's also vulnerable to CORS.

My hunch is that the "parameters" JSON data that you see there is actually the space where the post gets placed in the blockchain. Imagine knowing the next node in the blockchain without actually mining it :P Lmao

Whatever the case, I'm fugging laughing my butt off seeing how cancer it is. That's all I'm helping you out with.

[YourMom]

That is likely true that it's the next space in the blockchain. The backend is open source, so I might have a look. At some point, the client likely makes a call to get the next block, but I can't see where that is even occurring. Thanks for looking anyway.