Look for bugs in website

[Robertt]

Password is sent in plaintext when logging in - this isn't very good.

Password should be hashed client side and only the hash sent.

Actually, the password is hashed on my side. I'll look around the code and see if it's sent in plaintext although I'm pretty sure it isn't. How'd you find that?

You can see the POST request to login.php here https://i.imgur.com/PAJUukQ.png

Look at the form data sent - password is in plaintext.

Strange, I'm getting is as MD5.
I'll tighten it up on the new domain to a better encryption method.
What's your btc address

-- all payments will be sent within 24 hours from now

[1715166510]

1715166510

[1715166510]

1715166510

[1715166510]

1715166510

[TastyChillySauce00]

better for you to give a demo account mentioned on first post because not all of people want to sign up even it only take 5 minutes, just "demo" as user and password , simple but helpful

[Sigals]

Password is sent in plaintext when logging in - this isn't very good.

Password should be hashed client side and only the hash sent.

Actually, the password is hashed on my side. I'll look around the code and see if it's sent in plaintext although I'm pretty sure it isn't. How'd you find that?

You can see the POST request to login.php here https://i.imgur.com/PAJUukQ.png

Look at the form data sent - password is in plaintext.

Strange, I'm getting is as MD5.
I'll tighten it up on the new domain to a better encryption method.
What's your btc address

-- all payments will be sent within 24 hours from now

1LYkfhN97MdEt74uWhmYmZ53KbJ4iFJBcs

I'm not seeing any javascript being loaded to hash the password client-side, might want to check that.

[mxnsch]

Hi Rob....basically i still didn't understand what you sell with packages...
Daily Package / $3....for what?
No doubt that t site isn't a scam, but would be nice if you can explain to me (and others) what function your site have?
You sell "mining power" or what?
Thanks!

It's an account generator. I would look for bugs my self but I'm not on a pc right now so that limits my abilities.
@mxnsch Thanks for that, the first two aren't really bugs but the last three I'll count. what's your btc address?

I have to insist, those first are bugs security-wise and shall be addressed following best practices to secure customer data.

Please keep your BTC, i am doing professional penetration tests and was just having fun during a 5 minute lunch break. If you pay me, this would feel like work

Cheers and best of luck