[Game]

So I was sent a URL to look at someone’s username history and realised I was viewing the page through the discord browser and was not signed in.

To test, open a new private browsing window and paste the following link into the web address bar.

Using Extras>Username History (https://hackforums.net/uhsearch.php) I am greeted with “This is an Ub3r only feature.” as I am L33T but I can still obtain the results using the link below.

https://hackforums.net/misc.php?action=u...id=3539763 Used my own UID as an example.

Tl;dr - Username history(Ub3r only feature) can be viewed by anyone, without the need to be registered/logged in. Just obtain UID of target, then you can see their username history.

FAO: Omniscient

[Nostre]

Nice find. I’m sure once Omni sees this, it’ll be fixed.

[Game]

Nice find. I’m sure once Omni sees this, it’ll be fixed.

Thank you, hopefully it’s a simple fix. (Should be).

Just doing what I can to keep the community safe.

[Cooligan]

Can confirm this, just tested it myself:

Spoiler (Click to View)


Spoiler (Click to View)

[Cooligan]

U can also see who posted in a thread without logging in:
https://hackforums.net/misc.php?action=w...id=6233162

replace tid=ThreadID for any thread.

If you open this page while logged in you get this lol:
Spoiler (Click to View)
edit: Turns out it gives you the same page whether you're logged in or not:
Spoiler (Click to View)

[Cooligan]

even if ur logged out :D try it in incoginto mode.

Yeah check my post again, I updated it with a screenshot from a Brave private window.

[Cooligan]

nice. Wait I'll post some more.. I'll update my post :3
edit: updated!

Oh damn! Well shit this is gonna be fun lmao 😈

Nah I'm genuinely curious though what I'm able to find, will definitely report it back here as well.
I love snooping for little fixes like this on HF, always have.

I remember when we used to have a bunch of little easter eggs onsite, a bunch have since been deleted though.

[Game]

1. Who Posted - U can also see who posted in a thread without logging in:

replace tid=ThreadID for any thread.

https://hackforums.net/misc.php?action=w...id=6233162

---

2. Get Users - Search for users in the query (just like when u search for user to invite/convo somewhere)

https://hackforums.net/xmlhttp.php?actio...&query=m0h

---

3. HF Complix Password Check - I think its used when u signup.

Good Password: https://hackforums.net/xmlhttp.php?actio...assword123
Bad Password: https://hackforums.net/xmlhttp.php?actio...ord=qwerty

---

4. Username Availablilty - Check if the username is availble to register/change to.
- First you need to find your "Post_Key" here are the steps (even when logged out, u can get Post_key as a guest when you load HF, each time you close ur browser or close/open new incoginito window ull have new Post_Key to use.

Here's how to get the Post_Key value:
1. Open new HF page (either logged in or incoginto)
2. Wait for it to verify ur human/captcha thingy.
3. Right-Click anywhere -> View Page Source -> and search for: Post_Key

for example this is my Post_Key value as show in the picture above: xxxxxxc226a87610d675e69e201969bd


Now you can paste the Post_Key value in this URL and check for username availablity:

POSTKEY = ur post key.
USERNAME = username to check if available or not.

Code

https://hackforums.net/xmlhttp.php?action=username_availability&my_post_key=POSTKEY&username=USERNAME

https://hackforums.net/xmlhttp.php?actio...rname=m0hx

returns: "m0hx is already registered by another member" :D

---

Good stuff, was just about to add these to the thread but you already did.

There’s actually quite a few functions accessible outside of the user scope.

[Omniscient]

None of these are a concern.

Username History search is not the same as viewing a users specific username history.

The rest are just odd pages which don't require a login to get data. All harmless.

[Game]

None of these are a concern.

Username History search is not the same as viewing a users specific username history.

The rest are just odd pages which don't require a login to get data. All harmless.

Thank you for confirming. I wasn’t sure so thought to make you aware.