69 replies to this topic

[magda11us]

It only grabs parts of the Neopets cookie.

But if you are a Premium member they can grab your credit card right?

[Bains]

ok of course some people on this site use programs but its not like there saying ahahha you've been on here 4+years and I just took all your stuff and everything, theres a difference. I'd put it this way, there stealin the candy from the baby, were buyin the candy before the baby gets it =)

[sockopen]

But if you are a Premium member they can grab your credit card right?

If you can edit your credit card information and view it as a Premium Member, if he can just log onto your account and see these details, then yes. If when you login, you cannot view your own credit card details, neither can he. Besides all the cool kids are making themselves premium members without paying; I was going to write a program that did this, but it would be quite time consuming to write.

[Radiuju]

Meh, go ahead and tell me. I dont have a good account anyway. it'd be fun to see what they'd do with it.

[Mitch]

So your willing to bet $50 I can't go onto a few library's and find the exploit they used?

I don't give them any kind of respect, there newbs who are trying to steal a hackers image. They think this is going to make them 'cool' when in reality more like a script kiddie. That literally takes script kiddie to a new level.

Why hasn't this gone on Neopets before? Because it's a CENSOREDin site where 10 year olds play with their freakin 40 year old parents. No one's going to give a shit, if there is no money involved it just screams 'im usless' to any hacker.

My words excactly, Couldn't say it better

[Freddy]

Damn, exactly what I was going to say. You guy's worship fecking newbs who like to XSS kiddie sites

Respect the people that our hacking into govermental security and making it stronger everyday

everybody just think, if nobody hacked into the government or anything like that then we would not have the internet protection that we have today, I mean we would be screwed if we knew all the people today have the stuff and they dont have the protection, thank you hackers

[Radiuju]

I dont get how people would do that.....it just seems impossible..

[Mitch]

I dont get how people would do that.....it just seems impossible..

Becuase you haven't studied in that type of feild. It's really like a really easy thing to do if you go to geocites xss sites lol.

[sockopen]

I dont get how people would do that.....it just seems impossible..

http://www.cgisecuri...s/xss-faq.shtml

First thing that came up with my '"XSS Javascript" Newbie FAQ' Google search. Happy reading.

[Radiuju]

http://www.cgisecuri...s/xss-faq.shtml

First thing that came up with my '"XSS Javascript" Newbie FAQ' Google search. Happy reading.

Looks Informative and detailed....I'll just see how they did it. I dont play neo much anymore since guild wars...maybe 10 min a day if I feel like it

[magda11us]

The guy just cookie grabbed xxxx and neopets frozed his account like really quick.

[malevolent]

meh... Just avoid dealing with people- I doubt anybody has nearly what xxxx did (if so, kudos for not being iced, or wow for being a hrobi and looking on sites like this) - and so we'd probably be less than dots on the radar.

[Radiuju]

Who the heck invented it...and who knows about it? Is it possible to get protected?

[sockopen]

Who the heck invented it...and who knows about it? Is it possible to get protected?

Netscape, I think in 1996, I remember when it came out.

Almost everyone who has done any amounts of any research or learning about javascript.

In the FireFox browser, if you goto Tools -> Options... then under the 'Content' tab, you can disable Javascript. Any other sites that use Javascript will not work, for example, some of the things on this site will be disabled when you disable this. I don't recommend it. As for Internet Explorer, look for it, I don't have it on this computer.

Edited by sockopen, 29 December 2005 - 05:06 PM.

[RiceCooker]

so my paypal, ebay, etc accounts are safe except for my neopet account? since it only grab the neopets cookie

[shabba]

yes they are all hashed cookie details, when you see the Lock in the corner of the screen then that normally means its an encrypted page.
It really isnt that difficult, anyone with basic knowledge could do this. It HAS been done before as well so dont kid yourself it hasnt as I remember when, who and how it was done. Its not exactly the same exploit but its not far from it.
Terralis dont kid yourself with your Norton Security Suite crap or whatever firewall you have up. It might stop the basic brute forcing techniques but your far away from high secure. I have taken a course in Network security and the odd firewall will stop only but basic techniques.

[Radiuju]

Thanks for heads up

[shabba]

Also dont PM me again Terralis asking for instructions on how to make such a code as I will not reply.

[mystril]

More or less TNT might have taken care of it. Either which if Cookie Grabber is so rampant nowadays many accounts could have been taken away. >.> looks on Featheralley account. No harm done to her