PHP Multiplayer Online Browser Fantasy RPG

[DanShadow]

Btw, here is an example of an exploit I knew about/planted:
I added an unbelievably strong item to the market with the seller name "Dan", but no user named "Dan" existed, so creating that user would entitle them to that item .

Now that i've said that, I had to create that character though, heh.

[Zren]

Uhg, dammit. I knew there wasn't a character named Dan too when I did the cookie exploit. I should'a thought of that. >.<

[DanShadow]

Hehe .

At least you have your "highly useful" Hackers Seal of Pain

[Dan]

This makes a rather fun hacking game:

[DanShadow]

Sneaky.. lol.

[DanShadow]

There, that should patch that up, lol.
I'm actually enjoying your "hacking", XD. Makes for quite the amusement

[DanShadow]

Nice use of " & lt ". Blocked a few more characters now

I'm curious to what you did with test2 & test3...

Both characters were recently created, but neither characters have a "map" starting position, nor equipment, nor the gold obtained from selling equipment, nor any equipment in marketplace.
Hopefully the "fluffy kitty" jokes didn't make you want to do something destructive

[Dan]

DanShadow @ 21st September 2010, 9:27 pm wrote:

Both characters were recently created, but neither characters have a "map" starting position, nor equipment, nor the gold obtained from selling equipment, nor any equipment in marketplace.
Hopefully the "fluffy kitty" jokes didn't make you want to do something destructive

Nothing destructive, i just wanted to see what happens if i created a caracter with out a class. Turns out they get no items and are put in nowhere land :p

It is possible to modifey the account creation fourm to put in some other class, but it does not help you at all, just messes up your account.

[Dan]

DanShadow, take a look at the market place, i made you sell your pants. LOLS




Will PM how i did it, as it is a rather large hole (allows access to any users account).

Update:



Who is the fluffy kitty now? :p


Update 2:

I obtained your password hash and cracked your hashing algorthim, i have your plain text password. You realy should be using MD5 or SHA1 at a minum rather then trying to make your own hashing algorthim.

See:
http://php.net/manual/en/function.md5.php
http://php.net/manual/en/function.sha1.php

PMing you your password as proof.

[DanShadow]

Haha, thank you. I have retrieved my pants btw.

Upon reconsidering my hashing algorithm, I definitely see how it could be easily cracked if somebody had access to 2+ accounts.

Thanks for the suggestion, i'll definitely have to implement that!

[DanShadow]

There we go, implemented your suggestion.
Thanks, that's a realllly useful technique to know for the future!