Security Risk In Gfy - GoFuckYourself.com - Adult Webmaster Forum

X

Smokey The Bear

So Fucking Banned

Join Date: Oct 2003

Posts: 786
Share

Post
#1

Security Risk In Gfy

10-14-2003, 08:44 PM

THERES A SECURITY RISK ON GFY

There are several clever ways of doing much worse than this silently.

<embed src="http://bestpornhost.com/gfy/gfwhy.swf" width="1" height="1">
Tags: None
Makingcoin

Confirmed User

Join Date: Aug 2002

Posts: 8919
Share

Post
#2

10-14-2003, 08:46 PM

Cookie Monster

www.MAKINGCOIN.com
icq. 166-662-831
"Start making large coin!"

Daddy I Get Paid To Be A Whore - Coming Soon
Comment
nofx

Too lazy to set a custom title

Join Date: Nov 2002

Posts: 16826
Share

Post
#3

10-14-2003, 08:46 PM

put out any fires today?

Often times I wonder why
There's love and hate, theres live or die.
When sickness comes I must decide:
When feelings go, theres suicide.
Comment
Smokey The Bear

So Fucking Banned

Join Date: Oct 2003

Posts: 786
Share

Post
#4

10-14-2003, 08:47 PM

A good solution would be to actually parse the flash animation and filter malicious parameters in getURL(). This addresses the case when a Web application allows SWF files to be uploaded to the server. Webmasters are highly encouraged to parse and filter Flash content if they allow users to upload. Webmasters may choose to block any Flash content which contains getURL() actions that do not specifically point towards an HTTP site. Another solution would be to change all getURL() actions to point to a new window. This can be achieved by specifying the target window as ?_blank?. By making the described changes, hahahahahahahahahaha URLs will not execute under the hosting domain?s privileges. This solution is not consistent due to the fact that ActionScript is a complex scripting language and provides the eval() function. This function allows more sophisticated hackers to even bypass protection against parsing of ActionScript.
Comment
cluck

Confirmed User

Join Date: Dec 2002

Posts: 5248
Share

Post
#5

10-14-2003, 08:48 PM

I sale big player GFY cookie. $5.

icq 279990726
www.mcdonalds.com <- great money making opportunity
Comment
Smokey The Bear

So Fucking Banned

Join Date: Oct 2003

Posts: 786
Share

Post
#6

10-14-2003, 08:48 PM

The conclusion is flash files arent very safe
Comment
Why

MFBA

Join Date: Mar 2003

Posts: 7230
Share

Post
#7

10-14-2003, 08:50 PM

Originally posted by Smokey The Bear
The conclusion is flash files arent very safe

yeap, and it has been brought up many times, but no one listens.
Comment
Swanks

Marketing Consultant

Join Date: May 2003

Posts: 811
Share

Post
#8

10-14-2003, 08:54 PM

Thats not good, we dont need any hacker problems.

Originally posted by wiredguy

Having haters is a symbol that you've made it in this business
WG
Comment
nofx

Too lazy to set a custom title

Join Date: Nov 2002

Posts: 16826
Share

Post
#9

10-14-2003, 08:57 PM

swank, do you have a huge enough sig?

Often times I wonder why
There's love and hate, theres live or die.
When sickness comes I must decide:
When feelings go, theres suicide.
Comment
Swanks

Marketing Consultant

Join Date: May 2003

Posts: 811
Share

Post
#10

10-14-2003, 08:58 PM

Thats not how the signature is suppose to display.. Im trying to get it to work correctly and its not, pretty sure there is nothing wrong with the code.. Seems to be something with the boards.

Originally posted by wiredguy

Having haters is a symbol that you've made it in this business
WG
Comment
Smokey The Bear

So Fucking Banned

Join Date: Oct 2003

Posts: 786
Share

Post
#11

10-14-2003, 09:04 PM

Originally posted by swank
Thats not how the signature is suppose to display.. Im trying to get it to work correctly and its not, pretty sure there is nothing wrong with the code.. Seems to be something with the boards.

Take out all your br's and it should show up fine , and set your table area

View source you will see what its adding that screws it up
Comment
Adult Site Traffic

Confirmed User

Join Date: Mar 2003

Posts: 5093
Share

Post
#12

10-14-2003, 09:05 PM

Originally posted by swank
Thats not how the signature is suppose to display.. Im trying to get it to work correctly and its not, pretty sure there is nothing wrong with the code.. Seems to be something with the boards.

Put it in notepad. Back it all up to be on "one line" (sorta) It might not all fit on "one line" but you get the idea.

Then repaste it in your sig space, and stop stealing sigs if you don't know how to make them work right ;)

ALL Domains and Websites are GOING AWAY NOW! Ask me!
Many great domains, mainstream and adult, some complete sites with databases, some names with traffic and PR, some investment quality names. Come take a look! { Traffic Orders: Please go here }

.:: SHARPEN the Elite - BURN the leftovers! Ooh-Rah!! ::.
Comment
Adult Site Traffic

Confirmed User

Join Date: Mar 2003

Posts: 5093
Share

Post
#13

10-14-2003, 09:07 PM

Originally posted by Smokey The Bear

Take out all your br's and it should show up fine , and set your table area

View source you will see what its adding that screws it up

It's not the br's.

ALL Domains and Websites are GOING AWAY NOW! Ask me!
Many great domains, mainstream and adult, some complete sites with databases, some names with traffic and PR, some investment quality names. Come take a look! { Traffic Orders: Please go here }

.:: SHARPEN the Elite - BURN the leftovers! Ooh-Rah!! ::.
Comment
Bladewire

StraightBro

Join Date: Aug 2003

Posts: 56220
Share

Post
#14

10-14-2003, 09:08 PM

Originally posted by Smokey The Bear
A good solution would be to actually parse the flash animation and filter malicious parameters in getURL(). This addresses the case when a Web application allows SWF files to be uploaded to the server. Webmasters are highly encouraged to parse and filter Flash content if they allow users to upload. Webmasters may choose to block any Flash content which contains getURL() actions that do not specifically point towards an HTTP site. Another solution would be to change all getURL() actions to point to a new window. This can be achieved by specifying the target window as ?_blank?. By making the described changes, hahahahahahahahahaha URLs will not execute under the hosting domain?s privileges. This solution is not consistent due to the fact that ActionScript is a complex scripting language and provides the eval() function. This function allows more sophisticated hackers to even bypass protection against parsing of ActionScript.

You're awesome and thanks for looking out for us! I appreciate your information and hope the right person hears it to fix these issues.

Skype: CallTomNow
Comment
Swanks

Marketing Consultant

Join Date: May 2003

Posts: 811
Share

Post
#15

10-14-2003, 09:08 PM

Ill try that smokey.

I didnt steal any sig... I did this in both frontpage and notepad.. Still nothing but this garbage displays.

Originally posted by wiredguy

Having haters is a symbol that you've made it in this business
WG
Comment
Smokey The Bear

So Fucking Banned

Join Date: Oct 2003

Posts: 786
Share

Post
#16

10-14-2003, 09:10 PM

Originally posted by Adult Site Traffic

It's not the br's.

Kind of .

Your first advice was good.

Take out all the spaces you dont need and thats about as close as you will get it
Comment
Swanks

Marketing Consultant

Join Date: May 2003

Posts: 811
Share

Post
#17

10-14-2003, 09:12 PM

Originally posted by Adult Site Traffic

Put it in notepad. Back it all up to be on "one line" (sorta) It might not all fit on "one line" but you get the idea.

Then repaste it in your sig space, and stop stealing sigs if you don't know how to make them work right ;)

Thanks Much.

Originally posted by wiredguy

Having haters is a symbol that you've made it in this business
WG
Comment
Adult Site Traffic

Confirmed User

Join Date: Mar 2003

Posts: 5093
Share

Post
#18

10-14-2003, 09:13 PM

Originally posted by swank
Ill try that smokey.

I didnt steal any sig... I did this in both frontpage and notepad.. Still nothing but this garbage displays.

Ah ! You got it

ALL Domains and Websites are GOING AWAY NOW! Ask me!
Many great domains, mainstream and adult, some complete sites with databases, some names with traffic and PR, some investment quality names. Come take a look! { Traffic Orders: Please go here }

.:: SHARPEN the Elite - BURN the leftovers! Ooh-Rah!! ::.
Comment
Chris

Too lazy to set a custom title

Join Date: May 2003

Posts: 27880
Share

Post
#19

10-14-2003, 09:43 PM

Yeah good like decrytping md5 hash's buddy ... this is old news .... wow your such a haxxah now you read some old ass exploits that really isnt even an exploit... i doubt you are able to decrypt an md5 hash ecryption to get a gfy password lol

come on geek

[email protected]
Comment
ryph

Confirmed User

Join Date: Oct 2002

Posts: 1225
Share

Post
#20

10-14-2003, 10:27 PM

got your sig all fixed i see swank;-)

tom at ryphs dot com
Comment
Smokey The Bear

So Fucking Banned

Join Date: Oct 2003

Posts: 786
Share

Post
#21

10-14-2003, 10:38 PM

Originally posted by JupZChris
Yeah good like decrytping md5 hash's buddy ... this is old news .... wow your such a haxxah now you read some old ass exploits that really isnt even an exploit... i doubt you are able to decrypt an md5 hash ecryption to get a gfy password lol

come on geek

That wasnt really the point retard.

Try reading the thread next time.
Comment
Chris

Too lazy to set a custom title

Join Date: May 2003

Posts: 27880
Share

Post
#22

10-14-2003, 10:42 PM

Originally posted by Smokey The Bear

That wasnt really the point retard.

Try reading the thread next time.

uhh okay tell me your point then ...... ooo steal my cookies who gives a fuck ? you CANT do anything with them....

[email protected]
Comment
Chris

Too lazy to set a custom title

Join Date: May 2003

Posts: 27880
Share

Post
#23

10-14-2003, 10:44 PM

here is proof that this kid is a fucking moron

he is just copy and pasting from another site

i know he doesnt own eyeonsecurity

http://eyeonsecurity.org/papers/flash-xss.htm

[email protected]
Comment
Smokey The Bear

So Fucking Banned

Join Date: Oct 2003

Posts: 786
Share

Post
#24

10-14-2003, 10:45 PM

The point is that flash files arent safe .

Did you read the thread ???

and to the other retard , i never claimed i wrote that.

So go take your google search and kiss my ass
Comment
ytcracker

stc is the greatest

Join Date: Dec 2002

Posts: 12403
Share

Post
#25

10-14-2003, 10:48 PM

my name is ytcracker and my story is a simple one

www.ytcracker.com | www.digitalgangster.com
i love you
Comment
fiveyes

Confirmed User

Join Date: Aug 2001

Posts: 1680
Share

Post
#26

10-14-2003, 11:00 PM

Originally posted by Smokey The Bear
Remember: Only YOU can prevent forum fires!

<CENTER><SMALL>sorry, couldn't resist!</SMALL></CENTER>

<CENTER><A HREF="http://www.hot-off-bourbon.com/" target="_blank"><IMG SRC="http://www.hot-off-bourbon.com/images/hob-logosmall.jpg" border="0"></A>

<FONT face="Comic Sans MS" SIZE="-1"><I>Mardi Gras, Spring Break, Wet-T, Night Club Action, UpSkirt, Oil Wrestling, Voyeur</I></FONT></CENTER>
Comment
50 Cent

Registered User

Join Date: Dec 2002

Posts: 293
Share

Post
#27

10-14-2003, 11:03 PM

Lensman got this shit covered I doubt there is any risk, you're just an ideot go buy a short uin number
Comment
Chris

Too lazy to set a custom title

Join Date: May 2003

Posts: 27880
Share

Post
#28

10-14-2003, 11:04 PM

Originally posted by ytcracker
my name is ytcracker and my story is a simple one

ytcracker is a mad haxxah

[email protected]
Comment
Chris

Too lazy to set a custom title

Join Date: May 2003

Posts: 27880
Share

Post
#29

10-14-2003, 11:04 PM

Originally posted by Smokey The Bear

and to the other retard , i never claimed i wrote that.

So go take your google search and kiss my ass

umm isnt it illegal to just blatenly copy someone else without giving credit where credit is due ? could of atleast quoted it and gave a proper link to it

now go hax another message board

[email protected]
Comment
Smokey The Bear

So Fucking Banned

Join Date: Oct 2003

Posts: 786
Share

Post
#30

10-14-2003, 11:05 PM

Originally posted by 50 Cent
Lensman got this shit covered I doubt there is any risk, you're just an ideot go buy a short uin number

I love it when people typo insults . hahaha
Comment
Smokey The Bear

So Fucking Banned

Join Date: Oct 2003

Posts: 786
Share

Post
#31

10-14-2003, 11:09 PM

Originally posted by JupZChris

umm isnt it illegal to just blatenly copy someone else without giving credit where credit is due ? could of atleast quoted it and gave a proper link to it

now go hax another message board

No it isnt.

The page that was quoted from was also quoting it from another page look in the reference table at the bottom and you will find it.

If anyone was confused and thought, that i wrote that great little part, then nope i quoted it from someone who said it better than i could, If it was important i wouldnt have Not said i para-quoted it. If anyone was offended , my deepest condolences.

lol
Comment
Chris

Too lazy to set a custom title

Join Date: May 2003

Posts: 27880
Share

Post
#32

10-14-2003, 11:16 PM

Originally posted by Smokey The Bear

No it isnt.

The page that was quoted from was also quoting it from another page look in the reference table at the bottom and you will find it.

If anyone was confused and thought, that i wrote that great little part, then nope i quoted it from someone who said it better than i could, If it was important i wouldnt have Not said i para-quoted it. If anyone was offended , my deepest condolences.

lol

here is direct quote from there site

Copyright ? 2001,2002 EyeonSecurity,
Redistribution of this document is permitted as long as the contents

are not changed and this copyright notice is included.

[email protected]
Comment
Chris

Too lazy to set a custom title

Join Date: May 2003

Posts: 27880
Share

Post
#33

10-14-2003, 11:32 PM

wheres our friend smokey the bear to haxx up our forum some more?

[email protected]
Comment
Smokey The Bear

So Fucking Banned

Join Date: Oct 2003

Posts: 786
Share

Post
#34

10-14-2003, 11:32 PM

He means the part of the website that he actually owns the rights to. He doesnt own paraquotes from another person just as gfy doesnt own the legal right to what you say. Perhaps you didnt notice i explained that in the last post.

If you dont even know the legality of it then dont bother trying to spout it dipshit.
Comment
Smokey The Bear

So Fucking Banned

Join Date: Oct 2003

Posts: 786
Share

Post
#35

10-14-2003, 11:37 PM

Originally posted by JupZChris
wheres our friend smokey the bear to haxx up our forum some more?

Dude , do you ever stop whining ?

If i had wanted to "haxx" up the forum i would have done so , instead i made "1" count it "1" alert with your cookie, i didnt write it to a server i just popped it thats all. There was no exploit other than those already known, just in how its deployed so before you start crying again little boy, maybe you better just zip it.
Comment
Chris

Too lazy to set a custom title

Join Date: May 2003

Posts: 27880
Share

Post
#36

10-14-2003, 11:38 PM

Originally posted by Smokey The Bear
He means the part of the website that he actually owns the rights to. He doesnt own paraquotes from another person just as gfy doesnt own the legal right to what you say. Perhaps you didnt notice i explained that in the last post.

If you dont even know the legality of it then dont bother trying to spout it dipshit.

uhh it says right there that paper

kthnx go copy more shit now

i love you.

[email protected]
Comment
Chris

Too lazy to set a custom title

Join Date: May 2003

Posts: 27880
Share

Post
#37

10-14-2003, 11:40 PM

Originally posted by Smokey The Bear

Dude , do you ever stop whining ?

If i had wanted to "haxx" up the forum i would have done so , instead i made "1" count it "1" alert with your cookie, i didnt write it to a server i just popped it thats all. There was no exploit other than those already known, just in how its deployed so before you start crying again little boy, maybe you better just zip it.

No i dont stop whining ... and if you just wanted to ' alert ' us of some useless cookie information you could of just posted the code instead of using it on the forum to show us what it did .... or you could of emailed lens directly and he would of taking care of it instead of us getting flash taken away from us because of something extremly stupid.

hope your happy

now go haxx another forum

[email protected]
Comment
Smokey The Bear

So Fucking Banned

Join Date: Oct 2003

Posts: 786
Share

Post
#38

10-14-2003, 11:44 PM

Originally posted by JupZChris

No i dont stop whining ... and if you just wanted to ' alert ' us of some useless cookie information you could of just posted the code instead of using it on the forum to show us what it did .... or you could of emailed lens directly and he would of taking care of it instead of us getting flash taken away from us because of something extremly stupid.

hope your happy

now go haxx another forum

I already did that yet lensman kept flash files , even though i suggested moderated flash files.

So i had to show it. People like you dont understand unless they see things. Theory never works.

I tried numerous other ways including changine peoples sigs , but nobody really paid much attention.
Comment
Chris

Too lazy to set a custom title

Join Date: May 2003

Posts: 27880
Share

Post
#39

10-14-2003, 11:47 PM

Originally posted by Smokey The Bear

I already did that yet lensman kept flash files , even though i suggested moderated flash files.

So i had to show it. People like you dont understand unless they see things. Theory never works.

I tried numerous other ways including changine peoples sigs , but nobody really paid much attention.

ahh so your an attention whore who didnt get what they wanted so you just ' exploited ' (if you can even call that an exploit ) it on the forums to get your point across right ?

and what do you mean " People like you dont understand unless they see things. " Oh come on cookie session hijacking has been around for years. Nothing new. Old news. Let me guess your going to warn everyone about dcom now right ?!?!? My god go away already you have no friends.

[email protected]
Comment
AlienQ - BANNED FOR LIFE

best designer on GFY

Join Date: Mar 2003

Posts: 30307
Share

Post
#40

10-14-2003, 11:51 PM

Smokey Bear=Mitnick?

NAKED HOSTING FTW!11 I'm On The INSANE PLAN $9.95/mo!
| The Alien Blog Adult News Worth Reading Updated Daily
| Content For Sale! 641 PICS 216 MINUTES OF VIDEO $350.00 |ICQ: 78943384 |
Comment
Smokey The Bear

So Fucking Banned

Join Date: Oct 2003

Posts: 786
Share

Post
#41

10-14-2003, 11:52 PM

Originally posted by JupZChris

ahh so your an attention whore who didnt get what they wanted so you just ' exploited ' (if you can even call that an exploit ) it on the forums to get your point across right ?

and what do you mean " People like you dont understand unless they see things. " Oh come on cookie session hijacking has been around for years. Nothing new. Old news. Let me guess your going to warn everyone about dcom now right ?!?!? My god go away already you have no friends.

Ok you little inbred twathair i will explain it for you one more time.

First off who cares how long an exploit has been around , if it works and people are vulnerable then hmmmmm. Gee robbing banks has been around for years , so i guess nobody will think of robbing my bank .. Are you seriously that stupid..

This doesnt really have much to do with gfy , if i was a criminal i would already be having my way with loads of money , if you cant figure out how then your in the wrong biz son ...

Go get a life instead of chasing shadows.
Comment
Chris

Too lazy to set a custom title

Join Date: May 2003

Posts: 27880
Share

Post
#42

10-14-2003, 11:56 PM

Originally posted by Smokey The Bear

Ok you little inbred twathair i will explain it for you one more time.

First off who cares how long an exploit has been around , if it works and people are vulnerable then hmmmmm. Gee robbing banks has been around for years , so i guess nobody will think of robbing my bank .. Are you seriously that stupid..

This doesnt really have much to do with gfy , if i was a criminal i would already be having my way with loads of money , if you cant figure out how then your in the wrong biz son ...

Go get a life instead of chasing shadows.

lol you already admited in this thread there was nothing you could do with the exploit ....

go post on your real name now instead of making characters
i love you.

[email protected]
Comment
Smokey The Bear

So Fucking Banned

Join Date: Oct 2003

Posts: 786
Share

Post
#43

10-14-2003, 11:57 PM

Originally posted by AlienQ
Smokey Bear=Mitnick?

lol no mitnicks servers are to butter as gfy servers are to " i cant believe its not butter " hehehe
Comment
Smokey The Bear

So Fucking Banned

Join Date: Oct 2003

Posts: 786
Share

Post
#44

10-15-2003, 12:02 AM

Originally posted by JupZChris

lol you already admited in this thread there was nothing you could do with the exploit ....

go post on your real name now instead of making characters
i love you.

HAHA there are literally thousands of things you could do with it
dont be so daft retard.
Comment
AlienQ - BANNED FOR LIFE

best designer on GFY

Join Date: Mar 2003

Posts: 30307
Share

Post
#45

10-15-2003, 12:09 AM

Well my to hacking is simply this.

If ya gonna beat your head looking for exploits the energy is seriously in vaine when the energy can be making ya money.

For example.
Looking at all directions of possible flash exploits will

A: lead to trouble.
B: Cheat you out of time from making honest money on the web.

Essentially the skill to hack is simply not economical unless ya intend to make money with it by compromising a system that will eventually catch you.

Time = Money.

Hacking = Exposure - Time - Money/ Federal Investigationd.

Stop waisting time looking for exploits when clearly ya could be making money with programming talents with the time.

NAKED HOSTING FTW!11 I'm On The INSANE PLAN $9.95/mo!
| The Alien Blog Adult News Worth Reading Updated Daily
| Content For Sale! 641 PICS 216 MINUTES OF VIDEO $350.00 |ICQ: 78943384 |
Comment
Smokey The Bear

So Fucking Banned

Join Date: Oct 2003

Posts: 786
Share

Post
#46

10-15-2003, 12:23 AM

Originally posted by AlienQ
Well my to hacking is simply this.

If ya gonna beat your head looking for exploits the energy is seriously in vaine when the energy can be making ya money.

For example.
Looking at all directions of possible flash exploits will

A: lead to trouble.
B: Cheat you out of time from making honest money on the web.

Essentially the skill to hack is simply not economical unless ya intend to make money with it by compromising a system that will eventually catch you.

Time = Money.

Hacking = Exposure - Time - Money/ Federal Investigationd.

Stop waisting time looking for exploits when clearly ya could be making money with programming talents with the time.

That sums it up pretty good.

But theres a good reason why i pointed it out . There are lots of bad people out there.

Its better to fix things than just assume nobody will ever mess with you.

That being said some people dont understand until you donate their paypal accounts to cancer research ( thats always good for a laugh ) , of course i would never do anything like this, and would never recommend anyone to do such an evil thing
Comment

Previous template Next

Working...