Possible exploit found in Spyrochat

Doppelgangergang · Jul 15, 2008 5:07 AM

I noticed that the SpyroChat sends usernames and passwords in URLs. With the right stuff (I don't wanna go to details) I logged every URL I go to, including this:

http://www.spyrochat.com/index.php?rand=748745461&su=Doppelgangergang&pw=<REMOVED>&

That's the actual URL, minus my password of course. Seriously, if I am running a network and applied my magic on a router, I would have captured your logins when you go on my network and went on Spyrochat.

What do you think?

EDIT: I can also see it on my History.

DragonFireOKN · Jul 15, 2008 3:43 PM

I've noticed this ever since I got on the site. Since you could have seen our passwords, something needs to be done.

Doppelgangergang · Jul 15, 2008 4:49 PM

Also, I have demonstrated that I can impersonate people.

I can use a program and punch in "DragonFireOKN" and I can chat under your name.

Change your passwords regularly.

Spyrorocks · Jul 15, 2008 9:41 PM

cynderfan · Jul 17, 2008 8:29 AM

Oh dear that is bad...

Spyrorocks · Jul 17, 2008 5:07 PM

And doppel, you CANNOT sniff the communications from other people logging in UNLESS they are on the same LAN as you. Its all SERVER side, none of other people's login info passes through your router. It goes from their PC to the Spyroforum Server, where they are authenticated and get a session id unique to them.

I don't know where you came up with this crazy stuff about you being able to log other members over the internet.

Doppelgangergang · Jul 17, 2008 5:24 PM

No, it's just a "what-if" scenario for example. tongue

Also, do school/work administrators can log URLs the students/employees go to? I think they can. neutral

(But say hello to my SSL home proxy. :devil:)

Spyrorocks · Jul 17, 2008 5:32 PM

Say Hello to my VPN server.

Doppelgangergang · Jul 17, 2008 5:39 PM

I'm going to take a try on doing VPNs.

Hail The Ice Dragon · Jul 27, 2008 12:09 AM

>_< Sounds like a fight... *puts on whistle and black pants with striped shirt* Round 1! Doppel V.S. SR

Aicebo · Jul 27, 2008 12:16 AM

Spyrorocks · Jul 27, 2008 12:17 AM

How the heck did you ever think this was a fight? Don't dig up old threads.

DanteAndVergil · Jul 27, 2008 12:17 AM

This is best to be locked now as well yeah I have no reason for a change <_>

#1 Jul 15, 2008 5:07 AM

Possible exploit found in Spyrochat

#2 Jul 15, 2008 3:43 PM

Re: Possible exploit found in Spyrochat

#3 Jul 15, 2008 4:49 PM

Re: Possible exploit found in Spyrochat

#4 Jul 15, 2008 9:41 PM

Re: Possible exploit found in Spyrochat

#5 Jul 17, 2008 8:29 AM

Re: Possible exploit found in Spyrochat

#6 Jul 17, 2008 5:07 PM

Re: Possible exploit found in Spyrochat

#7 Jul 17, 2008 5:24 PM

Re: Possible exploit found in Spyrochat

#8 Jul 17, 2008 5:32 PM

Re: Possible exploit found in Spyrochat

#9 Jul 17, 2008 5:39 PM

Re: Possible exploit found in Spyrochat

#10 Jul 27, 2008 12:09 AM

Re: Possible exploit found in Spyrochat

#11 Jul 27, 2008 12:16 AM

Re: Possible exploit found in Spyrochat

#12 Jul 27, 2008 12:17 AM

Re: Possible exploit found in Spyrochat

#13 Jul 27, 2008 12:17 AM

Re: Possible exploit found in Spyrochat

Board footer