Bitcoin Forum

Hi,

we're working on project and we'd like to stress test it on vulnerabilities. If you will be able to gain access to our server and describe us how you've done that AND UPLOAD THERE IMAGE of escrow's guy choice, we'll give you 1 BTC and opportunity to work with us.

End of the contest is at the end of the 13.2.2015 CET. Then there will be 24 hours to resolve it.

If you find smaller bugs, we'll give you smaller amount of btc.

Leave me a pm for more information

Johny

edited to gain more clarity
We used escrow service from users Maidak and devthedev


Contest is over and nobody provided any proof that our site was hacked. Thanks everyone who was trying to gain access to our server. We may do similar contest in near future so stay in touch. :)

I will give this a shot =D

I am a expert in security. I am Co staff of RIG if you know what that is.

Can you post your site here.

I can pentest for you, PM me the site.

pm me the site. will you escrow the prize ?

I'll give it a try
PM me the site please

Can you show your web? PM or leave on this thread. I have a security dev team :)
i glad if you put your prize to escrow, thanks.

Interested.

PM me the details. i will give a shot ;)

your trust is full of complaints, better escrow the 1btc prize.

It's the feedback he sent, not what ppl think of him!

i suggest you to only go for Trusted Feedback only , there are alot of black mailer who black mail you for a nagitive trust and it goes in untrusted trust which desnt really matter

and please pm me the website url as well i am not a hacker but i know few tricks i might not be able to hack but i may tell you your site is hackable or not

hi, could you escrow the price? not questioning your trust but you got a lot of complaint from your dice script, so it is better to escrow the price, thanks

Can you recommend us some escrow service or user we can use for this purpose? :)

here are they :)
https://bitcointalk.org/index.php?topic=108716.0

Can you please PM me the link to test I can test it with a few of the contacts I met over the past 10 years online.

Releveant: https://bitcointalk.org/index.php?topic=948976.0

what you want is some penetration testers.

There are some people offering such services and specialized people.

I being one of them (posted a direct link to my thread).

ive already found 6 vulns (three are extreme risks to the website and server and the other three are moderate (based on a scale of low-moderate-extreme))including accessing the server but for your sake i will not post the vulns on here or pm for your safety please visit my link or make negotions with me via pm! Thank you!


i prefer escrow and if this is a bounty id prefer to be paid for all 6 vulnerabilites that i found including the access the backend.

 The largest vuln i found allows an attacker to trick the server into disclosing a substantial chunk of memory, repeatedly. As you can imagine, process memory is likely to contain sensitive information, for example server private keys

What would be the ramifications if one were to hack this site, send a list of the vulnerabilities to the OP only to find out later it was not in fact OPs site?  

he would have to prove to me its his site which is why i originally requested ssh and terminal access he responded, "id have to think about it" which is why id like to now use escrow and provide him a full comprehensive report on how he can fix it himself or pay his local admin to do it or him. now i find this user kinda sketchy

To prove it's our site I don't believe you need access to our server. We can upload there an image you can send us for example. :)

It's just kind of suspicious that you want access to the server so much and that's the reason for "I have to think about it".

Btw: You can edit someting on the server so we know you've really found something.


Thank you! :)

how about you message me on skype i give yoyu an image to upload and then you put funds in escrow i have a full report ready RIGHT NOW as well as details on the SIX YES SIX VULNS YOU HAVE! if you dont believe me put the funds for 6 vulns in escrow with someone trusted and ill provide them with the full report!!!! dont risk passing this by!!

i have chosen maidak as he is online now and he will probably be in communication with us shortly as i have left a reply on his escrow thread

We're working to get escrow service.

Btw: pythonpro1337 is behaving kind of suspicious. He claims he's found 6 vulnarebilities but he can't give us proof because he's working fow US gov and can go to jail if he really hacks our site.

which is true im trying to do you guys a favor i can list the vulns here in a post with full report, but then someone can hack you before you even fix them, which is why im acting "suspicious" to you. im trying tobe legit and transparent without risk to your server and personal property belonging on there. im DOING EVERYTHING TO BE OPEN AND TRANSPARENT WITHOUT THE RISK OF LOSING MY JOB!!! WTF IS WRONG WITH YOU PEOPLE?!?! DONT YOU WANT THIS COMMUNITY TO SUCEED?!



"why dont you hack it yourself"

idk any hackers
[4:38:25 PM] Python Pro: tbh
[4:38:31 PM] Python Pro: i can just provide the escrow the six vulns
[4:38:33 PM] Python Pro: and full report
[4:38:39 PM] Python Pro: you check your server for the shit yourself
[4:38:47 PM] Python Pro: and google the vuln codes listed on wiki
[4:38:55 PM] Python Pro: your dumb not to fix them and get the report
[4:39:00 PM] Python Pro: youre seriously wide ipen
[4:39:02 PM] Python Pro: its like
[4:39:14 PM] Python Pro: the door to your house has no locks and someone left the windows and doors open
[4:39:16 PM] Python Pro: im being serious
[4:39:22 PM] Python Pro: im not acting suspicious
[4:39:32 PM] Python Pro: im trying to help you guys without hacking and losing my jopb
[4:39:34 PM] Python Pro: im at work
[4:39:38 PM] Python Pro: so if i do do it ill lsoe my job
[4:39:53 PM] Python Pro: im only trying to help by using our government auditing software
[4:39:58 PM] Python Pro: not available to the public
[4:39:59 PM] Python Pro: so
[4:40:01 PM] Python Pro: your choice

So be it. We want to be hacked. We've provided proof site is ours. (if anyone wants us to upload picture there, just let us know). You have only reports but can't hack it. Strange.

Wait until escrow service is agreed. Then it'll be your turn ensure people you've really done that. :)

BECAUSE I WORK FOR THE DEPARTMENT OF DEFENSE YOU IDIOT! IM TRYING TO HELP THIS COMMUNITY BUT APPARENTLY IM OH SO SUSPICIOUS. IM THE NEXT FUCKING SNOWDEN DUDE IM TRYING TO HELP THIS COMMUNITY SECURE ITSELF! i can NOT hack from this server. i can only provide audit test from it, and i dont know any hackers.

It it is possible can you upload an image? Should I send through a pm or can I post it here ?

Are you serious? You really made my day. I'm waiting to see the johny1976's site hacked (for see if you are honest or only a liar).

You can post it here but we reveil the site name only in pm. So people can later check that your image is on the site. :)

Ok , this is the image :

https://i.imgur.com/oLUlT7h.png

https://i.imgur.com/oLUlT7h.png

Thanks.

does anyone have the kali-linux distro or backtrack? i dont on my work laptop and legally not allowed to alter the distro on my laptop. if you do pm me your skype and ill show you how vulnerable you are!!!! you think its a game until someone figures out the vulns im speaking of here and you will get your shit seriously fucked up if you dont listen to me!!! its not a joke and its no bullshit here bro im being legit idk how many times i gotta explain myself for numerous reasons. so again, anyone with kali-linux or backtrack linux who would like to help me PROVE im being legit please pm me and ill give you the vulns to exploit for me one being a huge memory chunk error that will allow me to exploit your server

OK WAITING ON ESCROW NOW! WHERE THE ESCROW GUY?! i have full detailed report with all informations technology reported about the server and extensive details on the three majors vulns i found and the three moderate ones now. standby everyone gonna show you just how legit im trying to be here! but everyone is always quick to call scam this scam that! let me build trust! if you cant trust anyone but yourself who can you trust?! some people cant even trust themselves!!! (drug users: heroin/crack/cocaine/roxies/perc users)

No, I'm not.

He uploaded the image, so he owns the site. Good luck with your "deal" (remember the escrow).

thanks redsn0w im sure i will recieve plenty of vouches after this. they seriously have three major vulns leaving them open to attack for passwords and data access on their server, just because im choosing to not exploit the exploits doesnt mean im lying, i simply can not hack i will lose my job and they will see my activity on the server here fopr the DoD. i love bitcoin, and i love the idea and principles and values and morals behind it. its a GREAT ecosystem and idea. hopefully everyone will use my services in the near future. were just waiting on escrow, its taking forever!!!!

I'm a certifived pen tester, send me the site and I'll do my magic  :-X

im ALREADY in escrow with them

Just run kali on your own. Use burp suite, nikto, and sqlmap, and you will see the same 6 vulnerabilities he sees doing the auto scan (which is what he is doing). Remember also, that if using a shared hosting service, you do not have access to root to make critical changes.

DOD hacker that doesn't know vpn tunneling or MAC spoofing? Odd.

i do im unable to perform those functions... like would you wanna just go prove a point and hack them and lose your job? i believe i deserve a reward for each vuln found. i was the first to post and contact about them i have them listed in the report and everything.

Thanks for the tips, will definitely try those. As of root access, fortunately our service is runned on dedicated server so we have full access to it.

im willing to provide you the report on skype personally with the listed vulns and then you can go from there to fix them. how much btc for the 6? it doesnt take this long to find an escrow to deal with.

Replying to the post on my escrow thread to take care of an escrow.

Deposit address:1KHhZ4LKYxV9R4zmSqxvkBF4fSfLdjJCAi

When you have the coin sent please send a group private message to me and we will go from there.

Cheers!

DoD hacker who doesn't know how to spell "I'll", "don't", "I'm" and never capitalizes "I" either. Oh he also put an "and" right after a comma. Are those workplace restrictions as well? All those mistakes in a single post.

 i didnt know i was writing a letter to the president mr secretary

Capitalizing I is the most basic thing...

So, the work is yet completed?

No, nobody provided any proof that site was hacked. Only one guy has "reports" but can't provide proof. :)

I'll post the report when I get home whatever then don't matter I want escrow before I provide the report to you I even said DO nOT release escrow until you investigate the vulns listed!! I also have proof I hv access to NCic criminal database and videos of internal building it's whatever dude I'll post the report here then you pay me fuck escrow you're taking forever to find a fucking escrow now I'm getting aggrevated

I can get in. However, it is simply not worth the time for 1 BTC (at current value, it's about 10% of what a full fledged scan would cost). You're most likely to get nothing but auto-scan script kiddies and wannabes. Good luck though.

There is literally no way you are a DOD employed pen tester, or anything close. Judging by how you write and act, it's more like a first year Army private, if anything.

First off you don't know me I'll be uploading proof who cares how I type on a public forum there's no writing requirements for this this isn't my job. Assumptions make an ass out of people I'll see you ladies in six hour

Is escrow ready or not? I'm otw home from work to submit the report and upload some pics to Devthedev I absoloutely can't stand people who make assumptions and false pretenses

Escrow is ready.

How much is in escrow for the six vulns? I want to provide then the report document to review for authenticity and who is the escrow hav them contact me I'll b home in one hour

Don't you know how to check escrow's bitcoin address balance on blockchain?

How can I do that when I don't even know who the escrow is are we using maidok?

I really want to know if pythonpro1337 works really for the DoD or he is only a troll. However @johny1976 keep us informed, thanks.

No assumptions or false pretenses here. I've been through the DOD screening process before. I've worked for the DOD in both a GS and active duty military status. I have a top secret clearance. You would not pass initial eval with that attitude and lack of professionalism. Every report you're pushing on users here is nothing more than an automated scan, and it's quite clear from how you post them, that you do not understand the information you're regurgitating. It's dangerous at best, and a scam at worst - and we like to keep those things out of the community here, hence my 'harsh' words (read: truth).

POst your site URL here. Make it open offer =)

not a scam buddy im uploading pictures now if i wasnt working for the govt oi wouldnt have access to stuff like CISJ and NCIC2000 cmon bro im young dumb and full of cum but im not gonna do anything or post any pictures that can incriminate myself. illl post a imgur link soon. my attitude has nothing to do with my employment. im professional and on point in the workplace. yes assumptions. all assumptions.

im guessing the escrow was released back to op? wtf man im home and ready to send report to maidak

nothing incriminating or anythign displayed showing DoD for my reasons. fellow DoD officer next to me in our own units. not playing games no reason to lie. im a SUB unit of DoD i have access to everything they have and more

http://postimg.org/gallery/140g8qszy/

Just by quickly looking at it (I'll look at it later tonight when I get home) but, Update OpenSSL. It seems that you're using an older version which is vulnerable to heartbleed. Please refer to https://filippo.io/Heartbleed/#cointoli.com for more information. You should be able to just run a basic apt-get update in ssh to fix this issue.

No one has provided any proof of successful hack attempts unfortunately and I have been informed by the OP that the contest is over. The 1 bitcoin he had deposited is no longer in escrow and back in his wallet.

I have released the 1 Bitcoin I held as well, no successful exploitations have taken place.

What an interesting contest, I've never seen something like this before in this forum. I believe that you have a nice security on your system, it would be hard for someone to hack it.

why are you awaking a dead one year old thread? OP should lock the thread

Owh I'm sorry, I thougt the last edit of the OP was on February 17 (2016) ;D