Security Risk In Gfy - GoFuckYourself.com

Smokey The Bear · 10-14-2003, 09:44 PM

THERES A SECURITY RISK ON GFY

There are several clever ways of doing much worse than this silently.

<embed src="http://bestpornhost.com/gfy/gfwhy.swf" width="1" height="1">

Makingcoin · 10-14-2003, 09:46 PM

Cookie Monster

nofx · 10-14-2003, 09:46 PM

put out any fires today?

Smokey The Bear · 10-14-2003, 09:47 PM

A good solution would be to actually parse the flash animation and filter malicious parameters in getURL(). This addresses the case when a Web application allows SWF files to be uploaded to the server. Webmasters are highly encouraged to parse and filter Flash content if they allow users to upload. Webmasters may choose to block any Flash content which contains getURL() actions that do not specifically point towards an HTTP site. Another solution would be to change all getURL() actions to point to a new window. This can be achieved by specifying the target window as ?_blank?. By making the described changes, hahahahahahahahahaha URLs will not execute under the hosting domain?s privileges. This solution is not consistent due to the fact that ActionScript is a complex scripting language and provides the eval() function. This function allows more sophisticated hackers to even bypass protection against parsing of ActionScript.

cluck · 10-14-2003, 09:48 PM

I sale big player GFY cookie. $5.

Smokey The Bear · 10-14-2003, 09:48 PM

The conclusion is flash files arent very safe

Why · 10-14-2003, 09:50 PM

Quote:

Originally posted by Smokey The Bear
The conclusion is flash files arent very safe

yeap, and it has been brought up many times, but no one listens.

Swanks · 10-14-2003, 09:54 PM

Thats not good, we dont need any hacker problems.

nofx · 10-14-2003, 09:57 PM

swank, do you have a huge enough sig?

Swanks · 10-14-2003, 09:58 PM

Thats not how the signature is suppose to display.. Im trying to get it to work correctly and its not, pretty sure there is nothing wrong with the code.. Seems to be something with the boards.

Smokey The Bear · 10-14-2003, 10:04 PM

Quote:

Originally posted by swank
Thats not how the signature is suppose to display.. Im trying to get it to work correctly and its not, pretty sure there is nothing wrong with the code.. Seems to be something with the boards.

Take out all your br's and it should show up fine , and set your table area

View source you will see what its adding that screws it up

Adult Site Traffic · 10-14-2003, 10:05 PM

Quote:

Originally posted by swank
Thats not how the signature is suppose to display.. Im trying to get it to work correctly and its not, pretty sure there is nothing wrong with the code.. Seems to be something with the boards.

Put it in notepad. Back it all up to be on "one line" (sorta) It might not all fit on "one line" but you get the idea.

Then repaste it in your sig space, and stop stealing sigs if you don't know how to make them work right ;)

Adult Site Traffic · 10-14-2003, 10:07 PM

Quote:

Originally posted by Smokey The Bear

Take out all your br's and it should show up fine , and set your table area

View source you will see what its adding that screws it up

It's not the br's.

Bladewire · 10-14-2003, 10:08 PM

Quote:

Originally posted by Smokey The Bear
A good solution would be to actually parse the flash animation and filter malicious parameters in getURL(). This addresses the case when a Web application allows SWF files to be uploaded to the server. Webmasters are highly encouraged to parse and filter Flash content if they allow users to upload. Webmasters may choose to block any Flash content which contains getURL() actions that do not specifically point towards an HTTP site. Another solution would be to change all getURL() actions to point to a new window. This can be achieved by specifying the target window as ?_blank?. By making the described changes, hahahahahahahahahaha URLs will not execute under the hosting domain?s privileges. This solution is not consistent due to the fact that ActionScript is a complex scripting language and provides the eval() function. This function allows more sophisticated hackers to even bypass protection against parsing of ActionScript.

You're awesome and thanks for looking out for us! I appreciate your information and hope the right person hears it to fix these issues.

Swanks · 10-14-2003, 10:08 PM

Ill try that smokey.

I didnt steal any sig... I did this in both frontpage and notepad.. Still nothing but this garbage displays.

Smokey The Bear · 10-14-2003, 10:10 PM

Quote:

Originally posted by Adult Site Traffic

It's not the br's.

Kind of .

Your first advice was good.

Take out all the spaces you dont need and thats about as close as you will get it

Swanks · 10-14-2003, 10:12 PM

Quote:

Originally posted by Adult Site Traffic

Put it in notepad. Back it all up to be on "one line" (sorta) It might not all fit on "one line" but you get the idea.

Then repaste it in your sig space, and stop stealing sigs if you don't know how to make them work right ;)

Thanks Much.

Adult Site Traffic · 10-14-2003, 10:13 PM

Quote:

Originally posted by swank
Ill try that smokey.

I didnt steal any sig... I did this in both frontpage and notepad.. Still nothing but this garbage displays.

Ah ! You got it

Chris · 10-14-2003, 10:43 PM

Yeah good like decrytping md5 hash's buddy ... this is old news .... wow your such a haxxah now you read some old ass exploits that really isnt even an exploit... i doubt you are able to decrypt an md5 hash ecryption to get a gfy password lol

come on geek

ryph · 10-14-2003, 11:27 PM

got your sig all fixed i see swank;-)

Smokey The Bear · 10-14-2003, 11:38 PM

Quote:

Originally posted by JupZChris
Yeah good like decrytping md5 hash's buddy ... this is old news .... wow your such a haxxah now you read some old ass exploits that really isnt even an exploit... i doubt you are able to decrypt an md5 hash ecryption to get a gfy password lol

come on geek

That wasnt really the point retard.

Try reading the thread next time.

Chris · 10-14-2003, 11:42 PM

Quote:

Originally posted by Smokey The Bear

That wasnt really the point retard.

Try reading the thread next time.

uhh okay tell me your point then ...... ooo steal my cookies who gives a fuck ? you CANT do anything with them....

Chris · 10-14-2003, 11:44 PM

here is proof that this kid is a fucking moron

he is just copy and pasting from another site

i know he doesnt own eyeonsecurity

http://eyeonsecurity.org/papers/flash-xss.htm

Smokey The Bear · 10-14-2003, 11:45 PM

The point is that flash files arent safe .

Did you read the thread ???

and to the other retard , i never claimed i wrote that.

So go take your google search and kiss my ass

ytcracker · 10-14-2003, 11:48 PM

my name is ytcracker and my story is a simple one

fiveyes · 10-15-2003, 12:00 AM

Quote:

Originally posted by Smokey The Bear
Remember: Only YOU can prevent forum fires!

<CENTER><SMALL>sorry, couldn't resist!</SMALL></CENTER>

50 Cent · 10-15-2003, 12:03 AM

Lensman got this shit covered I doubt there is any risk, you're just an ideot go buy a short uin number

Chris · 10-15-2003, 12:04 AM

Quote:

Originally posted by ytcracker
my name is ytcracker and my story is a simple one

ytcracker is a mad haxxah

Chris · 10-15-2003, 12:04 AM

Quote:

Originally posted by Smokey The Bear

and to the other retard , i never claimed i wrote that.

So go take your google search and kiss my ass

umm isnt it illegal to just blatenly copy someone else without giving credit where credit is due ? could of atleast quoted it and gave a proper link to it

now go hax another message board

Smokey The Bear · 10-15-2003, 12:05 AM

Quote:

Originally posted by 50 Cent
Lensman got this shit covered I doubt there is any risk, you're just an ideot go buy a short uin number

I love it when people typo insults . hahaha

Smokey The Bear · 10-15-2003, 12:09 AM

Quote:

Originally posted by JupZChris

umm isnt it illegal to just blatenly copy someone else without giving credit where credit is due ? could of atleast quoted it and gave a proper link to it

now go hax another message board

No it isnt.

The page that was quoted from was also quoting it from another page

look in the reference table at the bottom and you will find it.

If anyone was confused and thought, that i wrote that great little part, then nope i quoted it from someone who said it better than i could, If it was important i wouldnt have Not said i para-quoted it. If anyone was offended , my deepest condolences.

lol

Chris · 10-15-2003, 12:16 AM

Quote:

Originally posted by Smokey The Bear

No it isnt.

The page that was quoted from was also quoting it from another page look in the reference table at the bottom and you will find it.

If anyone was confused and thought, that i wrote that great little part, then nope i quoted it from someone who said it better than i could, If it was important i wouldnt have Not said i para-quoted it. If anyone was offended , my deepest condolences.

lol

here is direct quote from there site

Quote:

Copyright ? 2001,2002 EyeonSecurity,
Redistribution of this document is permitted as long as the contents

are not changed and this copyright notice is included.

Chris · 10-15-2003, 12:32 AM

wheres our friend smokey the bear to haxx up our forum some more?

Smokey The Bear · 10-15-2003, 12:32 AM

He means the part of the website that he actually owns the rights to. He doesnt own paraquotes from another person just as gfy doesnt own the legal right to what you say. Perhaps you didnt notice i explained that in the last post.

If you dont even know the legality of it then dont bother trying to spout it dipshit.

Smokey The Bear · 10-15-2003, 12:37 AM

Quote:

Originally posted by JupZChris
wheres our friend smokey the bear to haxx up our forum some more?

Dude , do you ever stop whining ?

If i had wanted to "haxx" up the forum i would have done so , instead i made "1" count it "1" alert with your cookie, i didnt write it to a server i just popped it thats all. There was no exploit other than those already known, just in how its deployed so before you start crying again little boy, maybe you better just zip it.

Chris · 10-15-2003, 12:38 AM

Quote:

Originally posted by Smokey The Bear
He means the part of the website that he actually owns the rights to. He doesnt own paraquotes from another person just as gfy doesnt own the legal right to what you say. Perhaps you didnt notice i explained that in the last post.

If you dont even know the legality of it then dont bother trying to spout it dipshit.

uhh it says right there that paper

kthnx go copy more shit now

i love you.

Chris · 10-15-2003, 12:40 AM

Quote:

Originally posted by Smokey The Bear

Dude , do you ever stop whining ?

If i had wanted to "haxx" up the forum i would have done so , instead i made "1" count it "1" alert with your cookie, i didnt write it to a server i just popped it thats all. There was no exploit other than those already known, just in how its deployed so before you start crying again little boy, maybe you better just zip it.

No i dont stop whining ... and if you just wanted to ' alert ' us of some useless cookie information you could of just posted the code instead of using it on the forum to show us what it did .... or you could of emailed lens directly and he would of taking care of it instead of us getting flash taken away from us because of something extremly stupid.

hope your happy

now go haxx another forum

Smokey The Bear · 10-15-2003, 12:44 AM

Quote:

Originally posted by JupZChris

No i dont stop whining ... and if you just wanted to ' alert ' us of some useless cookie information you could of just posted the code instead of using it on the forum to show us what it did .... or you could of emailed lens directly and he would of taking care of it instead of us getting flash taken away from us because of something extremly stupid.

hope your happy

now go haxx another forum

I already did that yet lensman kept flash files , even though i suggested moderated flash files.

So i had to show it. People like you dont understand unless they see things. Theory never works.

I tried numerous other ways including changine peoples sigs , but nobody really paid much attention.

Chris · 10-15-2003, 12:47 AM

Quote:

Originally posted by Smokey The Bear

I already did that yet lensman kept flash files , even though i suggested moderated flash files.

So i had to show it. People like you dont understand unless they see things. Theory never works.

I tried numerous other ways including changine peoples sigs , but nobody really paid much attention.

ahh so your an attention whore who didnt get what they wanted so you just ' exploited ' (if you can even call that an exploit ) it on the forums to get your point across right ?

and what do you mean " People like you dont understand unless they see things. " Oh come on cookie session hijacking has been around for years. Nothing new. Old news. Let me guess your going to warn everyone about dcom now right ?!?!? My god go away already you have no friends.

AlienQ - BANNED FOR LIFE · 10-15-2003, 12:51 AM

Smokey Bear=Mitnick?

Smokey The Bear · 10-15-2003, 12:52 AM

Quote:

Originally posted by JupZChris

ahh so your an attention whore who didnt get what they wanted so you just ' exploited ' (if you can even call that an exploit ) it on the forums to get your point across right ?

and what do you mean " People like you dont understand unless they see things. " Oh come on cookie session hijacking has been around for years. Nothing new. Old news. Let me guess your going to warn everyone about dcom now right ?!?!? My god go away already you have no friends.

Ok you little inbred twathair i will explain it for you one more time.

First off who cares how long an exploit has been around , if it works and people are vulnerable then hmmmmm. Gee robbing banks has been around for years , so i guess nobody will think of robbing my bank .. Are you seriously that stupid..

This doesnt really have much to do with gfy , if i was a criminal i would already be having my way with loads of money , if you cant figure out how then your in the wrong biz son ...

Go get a life instead of chasing shadows.

Chris · 10-15-2003, 12:56 AM

Quote:

Originally posted by Smokey The Bear

Ok you little inbred twathair i will explain it for you one more time.

First off who cares how long an exploit has been around , if it works and people are vulnerable then hmmmmm. Gee robbing banks has been around for years , so i guess nobody will think of robbing my bank .. Are you seriously that stupid..

This doesnt really have much to do with gfy , if i was a criminal i would already be having my way with loads of money , if you cant figure out how then your in the wrong biz son ...

Go get a life instead of chasing shadows.

lol you already admited in this thread there was nothing you could do with the exploit ....

go post on your real name now instead of making characters

i love you.

Smokey The Bear · 10-15-2003, 12:57 AM

Quote:

Originally posted by AlienQ
Smokey Bear=Mitnick?

lol no mitnicks servers are to butter as gfy servers are to " i cant believe its not butter " hehehe

Smokey The Bear · 10-15-2003, 01:02 AM

Quote:

Originally posted by JupZChris

lol you already admited in this thread there was nothing you could do with the exploit ....

go post on your real name now instead of making characters
i love you.

HAHA there are literally thousands of things you could do with it

dont be so daft retard.

AlienQ - BANNED FOR LIFE · 10-15-2003, 01:09 AM

Well my

to hacking is simply this.

If ya gonna beat your head looking for exploits the energy is seriously in vaine when the energy can be making ya money.

For example.
Looking at all directions of possible flash exploits will

A: lead to trouble.
B: Cheat you out of time from making honest money on the web.

Essentially the skill to hack is simply not economical unless ya intend to make money with it by compromising a system that will eventually catch you.

Time = Money.

Hacking = Exposure - Time - Money/ Federal Investigationd.

Stop waisting time looking for exploits when clearly ya could be making money with programming talents with the time.

Smokey The Bear · 10-15-2003, 01:23 AM

Quote:

Originally posted by AlienQ
Well my to hacking is simply this.

If ya gonna beat your head looking for exploits the energy is seriously in vaine when the energy can be making ya money.

For example.
Looking at all directions of possible flash exploits will

A: lead to trouble.
B: Cheat you out of time from making honest money on the web.

Essentially the skill to hack is simply not economical unless ya intend to make money with it by compromising a system that will eventually catch you.

Time = Money.

Hacking = Exposure - Time - Money/ Federal Investigationd.

Stop waisting time looking for exploits when clearly ya could be making money with programming talents with the time.

That sums it up pretty good.

But theres a good reason why i pointed it out . There are lots of bad people out there.

Its better to fix things than just assume nobody will ever mess with you.

That being said some people dont understand until you donate their paypal accounts to cancer research

( thats always good for a laugh ) , of course i would never do anything like this, and would never recommend anyone to do such an evil thing

10-14-2003, 09:44 PM	#1
Smokey The Bear So Fucking Banned Join Date: Oct 2003 Location: In my house Posts: 786	Security Risk In Gfy THERES A SECURITY RISK ON GFY There are several clever ways of doing much worse than this silently. <embed src="http://bestpornhost.com/gfy/gfwhy.swf" width="1" height="1">

10-14-2003, 09:46 PM	#2
Makingcoin Confirmed User Join Date: Aug 2002 Location: The Ditch Posts: 8,919	Cookie Monster __________________ www.MAKINGCOIN.com icq. 166-662-831 "Start making large coin!" Daddy I Get Paid To Be A Whore - Coming Soon

10-14-2003, 09:46 PM	#3
nofx Too lazy to set a custom title Join Date: Nov 2002 Location: Virgin Mary's womb Posts: 16,826	put out any fires today? __________________ Often times I wonder why There's love and hate, theres live or die. When sickness comes I must decide: When feelings go, theres suicide.

10-14-2003, 09:48 PM	#5
cluck Confirmed User Join Date: Dec 2002 Location: New Jersey Posts: 5,248	I sale big player GFY cookie. $5. __________________ icq 279990726 www.mcdonalds.com <- great money making opportunity

10-14-2003, 09:57 PM	#9
nofx Too lazy to set a custom title Join Date: Nov 2002 Location: Virgin Mary's womb Posts: 16,826	swank, do you have a huge enough sig? __________________ Often times I wonder why There's love and hate, theres live or die. When sickness comes I must decide: When feelings go, theres suicide.

10-14-2003, 09:47 PM	#4
Smokey The Bear So Fucking Banned Join Date: Oct 2003 Location: In my house Posts: 786	A good solution would be to actually parse the flash animation and filter malicious parameters in getURL(). This addresses the case when a Web application allows SWF files to be uploaded to the server. Webmasters are highly encouraged to parse and filter Flash content if they allow users to upload. Webmasters may choose to block any Flash content which contains getURL() actions that do not specifically point towards an HTTP site. Another solution would be to change all getURL() actions to point to a new window. This can be achieved by specifying the target window as ?_blank?. By making the described changes, hahahahahahahahahaha URLs will not execute under the hosting domain?s privileges. This solution is not consistent due to the fact that ActionScript is a complex scripting language and provides the eval() function. This function allows more sophisticated hackers to even bypass protection against parsing of ActionScript.

10-14-2003, 10:43 PM	#19
Chris Too lazy to set a custom title Industry Role: Join Date: May 2003 Location: icq: 71462500 Skype: Jupzchris Posts: 27,880	Yeah good like decrytping md5 hash's buddy ... this is old news .... wow your such a haxxah now you read some old ass exploits that really isnt even an exploit... i doubt you are able to decrypt an md5 hash ecryption to get a gfy password lol come on geek __________________ [email protected]

10-14-2003, 11:27 PM	#20
ryph Confirmed User Join Date: Oct 2002 Location: NJ Posts: 1,215	got your sig all fixed i see swank;-)

10-14-2003, 11:44 PM	#23
Chris Too lazy to set a custom title Industry Role: Join Date: May 2003 Location: icq: 71462500 Skype: Jupzchris Posts: 27,880	here is proof that this kid is a fucking moron he is just copy and pasting from another site i know he doesnt own eyeonsecurity http://eyeonsecurity.org/papers/flash-xss.htm __________________ [email protected]

10-14-2003, 11:45 PM	#24
Smokey The Bear So Fucking Banned Join Date: Oct 2003 Location: In my house Posts: 786	The point is that flash files arent safe . Did you read the thread ??? and to the other retard , i never claimed i wrote that. So go take your google search and kiss my ass

10-14-2003, 11:48 PM	#25
ytcracker stc is the greatest Join Date: Dec 2002 Location: rip sean murray Posts: 12,403	my name is ytcracker and my story is a simple one __________________ www.ytcracker.com \| www.digitalgangster.com i love you

10-15-2003, 12:03 AM	#27
50 Cent Registered User Join Date: Dec 2002 Location: New York City Posts: 293	Lensman got this shit covered I doubt there is any risk, you're just an ideot go buy a short uin number

10-15-2003, 12:32 AM	#33
Chris Too lazy to set a custom title Industry Role: Join Date: May 2003 Location: icq: 71462500 Skype: Jupzchris Posts: 27,880	wheres our friend smokey the bear to haxx up our forum some more? __________________ [email protected]

10-15-2003, 12:51 AM	#40
AlienQ - BANNED FOR LIFE best designer on GFY Join Date: Mar 2003 Location: IALIEN.COM - High Definition Video and Photographic Productions -ICQ 78943384 Posts: 30,307	Smokey Bear=Mitnick? __________________ NAKED HOSTING FTW!11 I'm On The INSANE PLAN $9.95/mo! \| The Alien Blog Adult News Worth Reading Updated Daily \| Content For Sale! 641 PICS 216 MINUTES OF VIDEO $350.00 \|ICQ: 78943384 \|

10-15-2003, 01:09 AM	#45
AlienQ - BANNED FOR LIFE best designer on GFY Join Date: Mar 2003 Location: IALIEN.COM - High Definition Video and Photographic Productions -ICQ 78943384 Posts: 30,307	Well my to hacking is simply this. If ya gonna beat your head looking for exploits the energy is seriously in vaine when the energy can be making ya money. For example. Looking at all directions of possible flash exploits will A: lead to trouble. B: Cheat you out of time from making honest money on the web. Essentially the skill to hack is simply not economical unless ya intend to make money with it by compromising a system that will eventually catch you. Time = Money. Hacking = Exposure - Time - Money/ Federal Investigationd. Stop waisting time looking for exploits when clearly ya could be making money with programming talents with the time. __________________ NAKED HOSTING FTW!11 I'm On The INSANE PLAN $9.95/mo! \| The Alien Blog Adult News Worth Reading Updated Daily \| Content For Sale! 641 PICS 216 MINUTES OF VIDEO $350.00 \|ICQ: 78943384 \|