 Show Posts
|
|
Pages: [1] 2 3 4 5 »
|
|
2
|
Economy / Services / Re: method to verify paypals
|
on: April 15, 2015, 10:02:07 PM
|
|
Here is the 100% legal method guys!
-> Use your own address
-> Use your own credit card
-> Use your own phone number
Legit method, works 100% of the time.
|
|
|
|
|
3
|
Economy / Services / Re: [100bit.co.in] Earn up to 0.1 BTC for finding bugs
|
on: April 10, 2015, 03:58:51 AM
|
your captcha is too weak and is almost useless to prevent bruteforce attacks and attacks like creating lots of tickets as mentioned above. I would advise to use strong captcha. It can be easily decoded with any OCR for example https://code.google.com/p/tesseract-ocr/downloads/list use tesseract-ocr-setup-3.02.02.exe after installing this just run command tesseract captcha.png decoded.txt -l eng example:  It will be accurate 95% of times. It is possible for an attacker to code some automated tool to launch bruteforce attacks, create 1000's of new users, create lot of supprot tickets etc. thanks How will the attacker create 1000's of new users ? It seems email authentication is required to create each user. Yea he can't forgot about email authentication. But still this captcha beats the purpose of using captcha. I already mentioned about using OCR Tesseract in my list and @OP didn't seem to care. You're 100% correct saying that it's possible to create thousands of accounts though. I could create a POC right now and make 100k+ accounts. Email verification / authentication is easily bypassable. I can just set up a mail server, buy a basic domain and just iterate through random email addresses on that domain and fetch the verification codes and verify them. This is an extremely simple process and I could clog up the server with thousands of users. In addition to this, there are more vulnerabilities that have been unpatched. 1. Post variable country on http://www.100bit.co.in/trade.php is SQL injectable. 2. Post variable trade on http://www.100bit.co.in/trade.php is SQL injectable. 3. http://www.100bit.co.in/support.php?mode=change_ststus&status=1&ticket_id=[ticketid] allows you to close or open any ticket regardless if you own it or not. This also has no CSRF or captcha protection on it. 4. http://www.100bit.co.in/order.php?mode=del_interest&id=[interestid] seems like you can delete other peoples interests as well. I could probably find even more, but seeing as the owner didn't want to pay me out for the others I found even though they were totally unique to the previous founds, I'm not going to waste anymore time on it. 100bitcoin, when you feel like actually paying out, then I may consider taking another look at it. |
|
|
|
|
4
|
Economy / Services / Re: [100bit.co.in] Earn up to 0.1 BTC for finding bugs
|
on: April 06, 2015, 12:18:46 AM
|
Earlier u said u will give me small bounty, now saying nothing, isnt good for a site owner, well have a good day !
You will definitely receive the small bounty we promised you. The bug you found is not related to XSS or SQLi. So, why should we drop you from the list ? in the title and the first post you didnt say bugs related to XSS or SQLi , it means any bugs. but now you say "The bug you found is not related to XSS or SQLi" , so is my report qualified for the bounty? Thanks XSS & SQLi bugs were first pointed out by MagicSnow & seoincorporation. So they are the 2 who will get bounty for those. What is the point of paying for a bug, which is already known ? Those who are finding other bugs will also be awarded bounty. That is why I am pointing to the order execution page on which no one has found a bug so far. Please note that the same XSS & SQLi bugs already exist in that page too. So no bounty for finding that known glitch. If you read over my list, you'd see a few. |
|
|
|
|
5
|
Economy / Services / Re: [100bit.co.in] Earn up to 0.1 BTC for finding bugs
|
on: April 05, 2015, 09:30:10 PM
|
1. The captcha could easily be detected by using OCT Tesseract, so that's completely useless. 2. http://www.100bit.co.in/authenticate.php?user_id=" (SQLi) 3. No CSRF protection anywhere 4. Vulnerable to clickjacking. 5. Modifying currency / country in settings so that the value = A string that breaks SQLi http://gyazo.com/70267440848463cbe9cf22e38fdc08cd (Not sanitized) so another SQLi here. Shows this SQLi on trade page. 6. "Name" on settings page vulnerable to XSS. 7. Shouldn't allow negative currencies http://gyazo.com/509791dd4e4fc300272d26e936cbcb12 . Massive issues could arise later on. 8. Payment mode on the orders page is vuln to persistent XSS. 9. By the looks of it, you can delete others buy orders http://www.100bit.co.in/order.php?mode=del&type=Buy&order_id=[orderid] 10. Persistent XSS in orders page by editing currency or country POST fields. 11. SQLi in trade page in post vars order and field. Escaping a string is not sufficient here as you're allowing the the person to chose the MySQL column. NEVER ALLOW THE CLIENT ACCESS TO ANYTHING THAT NEEDS TO BE DONE SERVER SIDED. 12. About Me in settings allows HTML, leads to XSS and other things such as good old iframing -> clickjacking on your site. 13. You can see everyone elses ticket IDs http://www.100bit.co.in/reply.php?ticket_id=[ticketid] and reply to them 14. XSS on the reply field of the ticket system. 15. The verify email token is an encrypted text that you obviously try to decrypt (I can see in the SQLi in authenticate.php). Don't have any tokens that contain informative values in them. I think I'll finish up there, I could probably continue and find even more. The site is heavily vulnerable and I would highly suggest allowing legitimate trading on it until all issues are fixed. I'd also suggest you use a PHP Framework such as laravel as you're not quite proficient in security with basic PHP. Regards, PotatoPie. |
|
|
|
|
8
|
Economy / Services / Re: Pen-tester wanted
|
on: February 15, 2015, 11:35:42 PM
|
Please PM me if you have experience pen testing sites/exchanges/apis. This ought to be an easy job because you'll get the source code to the entire site.
Specifically looking for experience with BTC full-node wallets.
I have a bit of experience with this. What is the site coded in? c#. Do you have any references for previous work in this field? Personally I don't have references for work with C#, mainly PHP and other web languages such as Ruby on Rails. If you would like, I can still go over your code for free as I have a bit of spare time although C# is probably one of my less proficient languages. |
|
|
|
|
9
|
Economy / Services / Re: Pen-tester wanted
|
on: February 15, 2015, 09:01:55 PM
|
Please PM me if you have experience pen testing sites/exchanges/apis. This ought to be an easy job because you'll get the source code to the entire site.
Specifically looking for experience with BTC full-node wallets.
I have a bit of experience with this. What is the site coded in? |
|
|
|
|
10
|
Economy / Services / Re: Need PHP/MYSQL expert to fix my Bitcoin faucet
|
on: February 14, 2015, 07:43:36 AM
|
I have just had a quick scan of the code, I don't think there is anything broken as such, just very cumbersome code for what needs to be done and sometimes a roundabout way of doing it. Firstly you don't want to be performing the following on shared hosting for every user that connects. $sql = "SELECT COUNT(*) AS num_addresses, MAX(balance) AS max_balance, SUM(balance) as sum_balance, ";
$sql .= "MAX(totalbalance) as max_totalbalance, SUM(totalbalance) as sum_totalbalance ";
$sql .= "FROM balances WHERE email <> 'SERVERBALANCE'"; The math should be done in PHP to take some of the load on the SQL Server. Also there is 12 calls to the SQL Server in the index.php file alone. let alone any external functions that are called from core.php. I think the best fix would be to change software or upgrade your hardware. Do you even SQL bro  ? I'll explain what this SQL statement is doing and why you're not correct in saying that this should be done PHP side. This SQL statement is getting 1. The count of all rows in balances (so the amount of users). 2. The maximum balance of any user (so the person with the most $$). To do this one PHP sided, you'd have to retrieve the whole balance row from the table with all of the data and then do it PHP sided. This would use more CPU than the SQL statement would. 3. The sum of the balances is just all of the balances in the table added together. This is the same as above and doing it using MySQL is far less resource intensive then getting the whole table and doing it with PHP. Your statement about "12 calls to the SQL Server in the index.php" isn't necessarily an issue. You'll find that a lot of PHP files have quite a few more queries. @OP: Try get information such as what pages are causing this issue with overusage of CPU from your host. I can try later on a VPS and see what the major issue is for you if you want. Are there any cron scripts running by any chance (haven't really looked at the code). |
|
|
|
|
12
|
Economy / Services / Re: [WTS] Government Level Penetration Testing & Security Audits
|
on: February 11, 2015, 04:12:36 AM
|
i wasnt threatening anyone you guys are fucking idiots man. i was trying to point out your sites had vulns whatever go fuck yourselfs then
Stop using shitty tools such as Acunetix without any knowledge about what these 'vulnerabilities' actually do. You're not part of the DOD, and please do not try threaten website owners. You're probably 12 and have no idea what you're doing. |
|
|
|
|
14
|
Economy / Services / Re: Security consulant/code reviewer
|
on: February 10, 2015, 10:24:07 AM
|
From what I read, you're just making stuff up on the spot with no actual experience of evidence to back it up. $40/hour is an absolute joke unless you can actually prove you know what you're doing. I know a lot of pentesters that are good and will work for less than that. Secondly, you're an idiot because you start flaming everyone on your sales thread. This is business 101, you're not going to get any clients and you might as well start a new thread and get a new mind set.
I am not flaming anyone, sure I am young and passionate about my work and like to call idiots by their rightful name, idiots. Throwing blank statements just appeals to the ignorant public, provide an argument I will provide a counter argument. $40 an hour on a full time job could indeed be relatively high, on a part time job I have seen offers worse than mine run up to 120 euro per hour. Business 101 is people who matter don't care and people who care don't matter, don't know how much business experience you have but I assure you nobody cares who and what I called someone in the free market. Those who care don't have the money to employ me for 15 minutes anyway. I've had plenty of business experience as I've run a business for many years. Customers generally don't flock towards you if you're volatile to other people that try to put you down. You're in a market where there is plenty of pentesters and almost no demand at all for them. You're not going to get someone giving you $40 an hour with no examples of what you can do and absolutely no idea what you're going to achieve in an hour. Join programs such as: -> Hackerone.com -> Bugcrowd.com Gain a bit of a profile and get on some bug bounty lists and then come back and try sell your services as you can prove that you at least know something  . Thank you for your feedback but pentesting is exactly what I am against if you bother to read the thread, there is no point in pentesting or in white hat hackers, if your system isn't faulty to begin with there is no reason to ask a white hat hacker to attempt to exploit it. A lot of the time, it's not the code that is vulnerable. I'll be honest in saying that when I used to do 'illegitimate testing' against websites, the code was normally not the issue. You'll find now that people are using frameworks more and more that get rid of the issues such as the owasp top 10 and so on. It also comes down to the issue that if they're using a lot of classes and a large system (PHP), it would take a long time to go through multiple PHP files just for one single function (hence the per hour thing being a bit ridiculous here). |
|
|
|
|
15
|
Economy / Services / Re: Security consulant/code reviewer
|
on: February 10, 2015, 10:04:35 AM
|
From what I read, you're just making stuff up on the spot with no actual experience of evidence to back it up. $40/hour is an absolute joke unless you can actually prove you know what you're doing. I know a lot of pentesters that are good and will work for less than that. Secondly, you're an idiot because you start flaming everyone on your sales thread. This is business 101, you're not going to get any clients and you might as well start a new thread and get a new mind set.
I am not flaming anyone, sure I am young and passionate about my work and like to call idiots by their rightful name, idiots. Throwing blank statements just appeals to the ignorant public, provide an argument I will provide a counter argument. $40 an hour on a full time job could indeed be relatively high, on a part time job I have seen offers worse than mine run up to 120 euro per hour. Business 101 is people who matter don't care and people who care don't matter, don't know how much business experience you have but I assure you nobody cares who and what I called someone in the free market. Those who care don't have the money to employ me for 15 minutes anyway. I've had plenty of business experience as I've run a business for many years. Customers generally don't flock towards you if you're volatile to other people that try to put you down. You're in a market where there is plenty of pentesters and almost no demand at all for them. You're not going to get someone giving you $40 an hour with no examples of what you can do and absolutely no idea what you're going to achieve in an hour. Join programs such as: -> Hackerone.com -> Bugcrowd.com Gain a bit of a profile and get on some bug bounty lists and then come back and try sell your services as you can prove that you at least know something . |
|
|
|
|
17
|
Economy / Services / Re: [WTS] Government Level Penetration Testing & Security Audits
|
on: February 10, 2015, 03:36:43 AM
|
atomic-trade.com (23.101.121.25)
HTTP server signature Microsoft-IIS/8.5
Downgrade attack prevention = No, TLS_FALLBACK_SCSV not supported
This server accepts the RC4 cipher, which is weak. = RC4 Yes WEAK
This is straight out of an automated testing tool, not government grade pen-testing. If you can fully explain what this is and how to exploit it then people may slightly believe that you're capable of such things. |
|
|
|
|
18
|
Economy / Services / Re: Security consulant/code reviewer
|
on: February 10, 2015, 03:34:09 AM
|
You just got torn appart.
You failed at EVERYTHING you said.
Now you wish to claim you were making nostalgic references to historical crap as a joke.
You were completely NOT funny, and you were completely serious in the bullshit you wrote.
That is why you did not DARE respond to the individual points everyone makes ripping apart you fake intelligence.
When I joke about port 139 nukes, it was clearly a joke.
When you write about 1s and 0s, you were completely serious.
You are an idiot for claiming that someone making 120k a year lacks financial intelligence.
Now you want to pretend that I was focused on 60k per year, and pretend that you make that when you are posting bullshit security consultant ads on a thread that you yourself say would make anyone an idiot for employing you.
You fail in every way.
Your reading comprehension amazes me, we should dissect you and study your dumb brain. Overall I am still willing to examine businesses for either a stake in the company or monetary compensation, call it giving back to the community. Please give me one point when I got "torn apart", just one. From what I read, you're just making stuff up on the spot with no actual experience of evidence to back it up. $40/hour is an absolute joke unless you can actually prove you know what you're doing. I know a lot of pentesters that are good and will work for less than that. Secondly, you're an idiot because you start flaming everyone on your sales thread. This is business 101, you're not going to get any clients and you might as well start a new thread and get a new mind set. |
|
|
|
|
20
|
Economy / Services / Re: fix my php - blockchain.info ticker call
|
on: December 17, 2014, 06:24:17 AM
|
the following code was working to retrieve the usd price, now for some reason its not <?php require 'Mysql.php'; require 'Util.php'; $file = file_get_contents(" http://blockchain.info/ticker"); $vars = json_decode($file, true); $usd = $vars['USD']['15m']; $net_usd = number_format((($usd) * (100 - Settings::fee)) / 100, 2); echo $net_usd returns zero when should be the price. offering 0.1 btc to someone who can fix. You left out where Settings::fee is coming from. If the class Settings isn't found, you'd get a fatal error. The fact that you aren't indicates that it's mis-defined somewhere. You'll need to either post more code, or do digging with that lead yourself. Probably in Util.php, but I doubt that would be an area of concern as it seems to have just 'stopped working'. the following code was working to retrieve the usd price, now for some reason its not <?php require 'Mysql.php'; require 'Util.php'; $file = file_get_contents(" http://blockchain.info/ticker"); $vars = json_decode($file, true); $usd = $vars['USD']['15m']; $net_usd = number_format((($usd) * (100 - Settings::fee)) / 100, 2); echo $net_usd returns zero when should be the price. offering 0.1 btc to someone who can fix. Try changing the url in file_get_contents to be https:// $file = file_get_contents("https://blockchain.info/ticker");Blockchain.info recently changed some things around, and maybe you're not getting the file through redirect. I was able to use http and it seems that there is no redirects without https. Blockchain is behind cloudflare which could be causing blocking issues (I've had it various times before). |
|
|
|
|
