CCBill .htaccess nightmare - GoFuckYourself.com

TheSaint · 04-30-2004, 08:16 PM

I decided to reconcile my password files on some sites.

Knowing how things work I assumed there would be some bogus users in there, and in fact I found about 10.

Not bad, for a year, but more than I thought I would find.

It's not really CCBill's fault in my view (shit happens) but they should provide a tool to help reconcile the file - I ended up spending hours extracting users from CCBill reports, loading into mysql, and joining on .htaccess.

Way too much work, but I'm going to do it occasionally from now on.

If you have a paysite there is a good chance you have some expired users also with lifetime free access; you might want to take a look.

doober · 04-30-2004, 08:21 PM

im afraid to look

Rictor · 04-30-2004, 08:22 PM

Yes, a tool would be very nice.

WebTitan · 04-30-2004, 08:24 PM

i had a nightmare with a client we jsut setup with them on that too. was liking jumping thru hoops to try and fix that shit

Ray@TastyDollars · 04-30-2004, 08:26 PM

this may be a stupid question, but how did they get there.
Hacks or other?

Bigjohn · 04-30-2004, 08:30 PM

I had the same thing. Pennywize would disable a a username for multiple accesses/different IPs but when I checked in CCBill, they weren't listed as a member.

Turns out that my CCBill script was sitting where it was easy to find and hackers were managing to hahahahahahaha the script and create fake accounts. The Tech on the phone had it fixed in like two seconds. Now my script is safely hidden in a randomly named directory that's about a billion characters long

emmanuelle · 04-30-2004, 09:10 PM

Since they brought out the newer J scripts, everything works great. Make sure that the old password file isnt still in an accessable directory or you can be sure it will be found and all those usernames will be hammered.

High Quality · 04-30-2004, 09:12 PM

Quote:

Originally posted by emmanuelle
Since they brought out the newer J scripts, everything works great. Make sure that the old password file isnt still in an accessable directory or you can be sure it will be found and all those usernames will be hammered.

This is CCBILL? I have about a year old script, as far as I know...

TheSaint · 04-30-2004, 09:17 PM

Everything on my server is as secure as you can get - the password file is not in the web tree, the ccbill script name is random, etc.

Be very afraid.

04-30-2004, 08:16 PM	#1
TheSaint Confirmed User Join Date: Jun 2003 Location: Everywhere at once Posts: 991	CCBill .htaccess nightmare I decided to reconcile my password files on some sites. Knowing how things work I assumed there would be some bogus users in there, and in fact I found about 10. Not bad, for a year, but more than I thought I would find. It's not really CCBill's fault in my view (shit happens) but they should provide a tool to help reconcile the file - I ended up spending hours extracting users from CCBill reports, loading into mysql, and joining on .htaccess. Way too much work, but I'm going to do it occasionally from now on. If you have a paysite there is a good chance you have some expired users also with lifetime free access; you might want to take a look. __________________ I have no signature

04-30-2004, 08:26 PM	#5
Ray@TastyDollars www.TastyDollars.com Join Date: May 2002 Location: Montreal Posts: 6,797	this may be a stupid question, but how did they get there. Hacks or other? __________________ The nets best interracial and cuckold site The nets hottest teen site ICQ me: 161 375 873

04-30-2004, 09:17 PM	#9
TheSaint Confirmed User Join Date: Jun 2003 Location: Everywhere at once Posts: 991	Everything on my server is as secure as you can get - the password file is not in the web tree, the ccbill script name is random, etc. Be very afraid. __________________ I have no signature

04-30-2004, 08:21 PM	#2
doober Confirmed User Join Date: Jul 2003 Location: in yoOoo kitchen Posts: 6,984	im afraid to look

04-30-2004, 08:22 PM	#3
Rictor Old Timer Industry Role: Join Date: Jan 2001 Location: Indianapolis Posts: 12,208	Yes, a tool would be very nice.

04-30-2004, 08:24 PM	#4
WebTitan Confirmed User Join Date: Mar 2003 Location: Western NY Posts: 5,114	i had a nightmare with a client we jsut setup with them on that too. was liking jumping thru hoops to try and fix that shit

04-30-2004, 08:30 PM	#6
Bigjohn Confirmed User Join Date: Feb 2003 Location: Deep inside my mind Posts: 1,118	I had the same thing. Pennywize would disable a a username for multiple accesses/different IPs but when I checked in CCBill, they weren't listed as a member. Turns out that my CCBill script was sitting where it was easy to find and hackers were managing to hahahahahahaha the script and create fake accounts. The Tech on the phone had it fixed in like two seconds. Now my script is safely hidden in a randomly named directory that's about a billion characters long

04-30-2004, 09:10 PM	#7
emmanuelle Confirmed User Join Date: Mar 2003 Location: Oh Canada! Posts: 3,662	Since they brought out the newer J scripts, everything works great. Make sure that the old password file isnt still in an accessable directory or you can be sure it will be found and all those usernames will be hammered.