toursumo.tk questions & answers

[Concord]

you already know what you were exploiting, why can't you just tell me so I can make sure it's secure?

dlh has looked over the code and I believe most of it has been fixed already.

[TheDelta]

ok concord,
unsuspend me and let me try to find bugs,
if I still find them, I will tell you where they are and you can fix them, with help of me or dhl.

deal ?

[Concord]

you lost the benefit of the doubt already. tell me the ones you already were using and we'll see.

[TheDelta]

concord,
you should trust me on this one.
consider this is the last chance for me, I won't do any shit..

I'll just check if its fixed (good) and what isn't fixed yet, you got my word.

[Concord]

you need to give me something before i give you something.

[TheDelta]

uuhm well prevent logging in as:
Delta
DElta
DELta

prevent exploit, easy done by only allow a-z, A-Z.
so if I try again something like:
<script>alert('hi')</script>

it will be filtered as:
script alert hi script

[Concord]

already fixed both those things

[TheDelta]

well..
I gave you something , I hope you now let me check for other bugs
(ex. manual adding a script to your site to manipulate the form).

[Light]

uuhm well prevent logging in as:
Delta
DElta
DELta

prevent exploit, easy done by only allow a-z, A-Z.
so if I try again something like:
<script>alert('hi')</script>

it will be filtered as:
script alert hi script

There are much better ways to prevent XSS attacks than to filter regex.

well..
I gave you something , I hope you now let me check for other bugs
(ex. manual adding a script to your site to manipulate the form).

What you gave was about the most basic attack there is though. :X

you need to give me something before i give you something.

You could always chroot a sandbox and let people try to screw with it. It could prove to be useful.

[Concord]

here you go delta: http://incam.tk/

go nuts

[TheDelta]

ic tnx,
but I need an account so could you manually make some accounts or activate delta ?

[TheDelta]

I see, delta is in the list.
but when I try login, I am still suspended (redicted to home, nothing happens)

[Light]

here you go delta: http://incam.tk/

go nuts

If you were at risk of an XSS attack, you may be for SQL injection as well. I wouldn't keep it on the same database if you were to let him mess around.

I'm assuming that's a copy of the files anyways.

[Concord]

it's not the same database
delta, try again

[TheDelta]

yep it works,
I'll keep you updated on everything I find