Sethioz Forum

KEN wrote:I looked at it but had to sign up so i closed it.. I will sign up and give it a try tonight.

How did it go? Were you able to hack it?

Not to sound annoying, but how would I go about doing this?

Hello Sethioz. I have recently started to try and hack flashchat again, preferably www.roleplaychat.org. Doesn't seem to work however. Any help? Maybe it was patched?

Looks like someone's been having too much fun banning.. (not me)..

Someone on the chat I usually go to banned me, and I tried tampering with the login but have no clue what I can do to unban myself or even if I'm doing it right..

True, some need direct packet and some don't from my testing.

Is there a way to add permanent rooms?

Ahh, now I see, finally get it now..

I'm guessing this should work with any of the other admin commands.

Ah, all right, thanks, now I get it.

All that's left is to get the kickout packet, I tried getting it from a default chat but it was interpreted as a message because I had to use the command.

Oh, all right. I see now.

Although, on paros, I'm using 3.2.13, and on tools-filter, I enable "Replace HTTP request body using defined pattern", and the response body, right?

I'm sorry for the confusion and irritation, but it doesn't seem to work for me after I used the packet with tamper data. (The command won't work after I submit the tamper and ban/gag/kick someone, and s=7 was added.) I'm only wondering do I need paros proxy for them to actually work? By reading the ...

I know, I've read, but I'm wondering when I'll be able to execute the command and when it's able to work.

Like for example, with the ban packet, I used it to ban a user off of the chat, am I then able to use the full command?

Just s=7? I always had that in my ban packet and whenever I tried the command, didn't work.

Do you mean using it from tamper data, or using the privileges from the commands themselves if you add s=7?

Yeah, very true about the cookie stealing and such..

Now, does anyone here know a gag or kick packet for tamper data? Trying to get one of those.

Ok, by inviting someone on a chat while tamper data is started, you can get the person's ID where it says "u=" on the post data, what I just figured out. But now to figure out, how can you set the amount of time the person's banned for? EDIT: Here's an awesome code, whoever clicks your nam...

Here's one that I like to tamper about with often.

http://tailedfox.com/chat/flashchat.php

They use 4.7.11, which means HIGHLY screw able.

And there's also at least 30 users on a day on the flashchat alone, pretty popular place.

:)

Sethioz wrote: /me < quite brilliant idea actually, </b> is blank name or something ?

Yep, </b> logs you in as a blank name so it's perfect for impersonating others.

All right, from a little googling and looking back, I found that using this exploit can work for banning: http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2008-10/msg00138.html First, you log in as ROLE_ADMIN with password $req['s'] == 7 Then, go into tamper data, type a message, hit sta...

Hello, Sethioz. I've been "tampering" with flashchat recently, and I know currently how to ring the bell, and how to change my symbol to admin-mod, the only problem I have is, how can I retrieve someone's ID?