Bypass 275 limit on AO Addicts forum.

I believe I found a way to post to the AOAddicts forum with out having the required 275 posts. Unfortunately I can't confirm this because I cannot view the AOAddicts forum. However, my name is listed as the last poster to a few AOAddict threads. If someone can confirm that my posts were added to the restricted thread, I will be glad to share how to fix this bug with JP.

--------------------------

Note: Bug has now been fixed. Here is an explanation of how I was able to post in the AO Addicts area:

Terr was on the right track when he mentioned manipulating the form input. What I did was I copied the HTML form for the Quick Reply, and saved it into an HTML file on my computer. Had to make some small modifications to the form such as removing the onsubmit command in the form tag, and making the action value point to the whole URL instead of just the php file. The thread ID you are replying to is coded in a hidden input type named "threadid". I changed the thread ID to the AO Addicts thread ID I wanted to post to. Then I just typed in what message I wanted, and clicked submit. It would post the message to the restricted forum. I still couldn't view the message because there was a post check before you can view AO Addicts messages, but I could still see my user name listed as the last person to post to that thread.

Reasons why this would work would be that there was no post number check when submitting a reply to an AO Addicts forum, or there is no refer check to make sure the HTML form was being submitted from AO. I think in this case JP had the code there, but it wasn't working right for some reason. I'll leave that for him to go into details with, because I really don't know for sure what the code was on his end.

But for the guys who do web development, take note that you should always have a refer check on your forms to make sure they are only being submitted from your site. Otherwise someone may simply be able to copy the HTML code, save it locally, and edit the hidden input types to their hearts content.

Thanks to RCGreen for confirming that my posts did get added to the AO Addicts Forum. It was nice to see JP get right on this within minutes of me reporting the bug. Unlike some other companies that would wait weeks to fix it. ::: cough ::: microsoft ::: cough :::

So JP, how about you give me access to the AO Addicts forum since I found and reported this bug? Hey, I had to ask. :)

Now that's what I call hacking.
:cool:

Yes, I'm an AOaddict and your posts are there.
That's cool.
:cool:

nice... thanks. :)

So, how did you do it?
Are you going to tell?

Greetings All:

Well, I think that I have this fixed. Seems as though some dumb ass forgot to include a file in newthread.php and newreply.php.

jared_c, if you were doing what it looks like you were, can you confirm that I now have the problem fixed?

I'm only going to tell JP until the bug is fixed. Reason why is because it seems like some more serious things on the site may be vulnerable to the tactic I used. Deleting PM's and entire Forums may be possible. I am not sure because I didn't want to go try that, but I'm going to keep it confidential until the bug is fixed just in case. After that though, I'll gladly share how it was done. :)

It seems like it isn't fixed yet JP... I just posted to the Remark thread in the AO Addicts section. Would you like me to PM you exactly how I am doing this? It is an easy fix....

haha wow.. i like ur avatar jared.. lolz

Thanks s0nic... I'm working with JP right now to fix the bug. :cool:

Excellent....... jared_c...........
Damn fine job..........Have some greenies......... :thumbsup:

Just goes to show you what you can learn if one hangs around and learns. The noobs should take note of his actions. This is what we do and what we are here for. Secure those puters people. We can all learn new stuff. Ones never to old nor to wise to learn. Keep up the good work.

Did you do some fakery in terms of form input? Changing the forumID that is passed to the post form? That's what I'm guessing, but I can't attempt it from the same conditions. <shrug>

yeah terr thats what i thought at first but i cant get it to work i thought he could be whatching packets and used proximitron but hes not doing that cause i asked him lol so back to trying hehe shows u how bored i am

Greetings All:

Well, I think I finally have things fixed up. jared_c worked with me for about an hour, and I've spent the last several hours working on this.

jared_c, can you verify that this problem has now been fixed? Once it has, either you or I can post more details about what the problem was.

thanks.

This is for jared_c

I was very impressed by the way you handled this situation. I wish that more people on the net would act as responsibly as this. You deserve a bucket of greenies for this.

/me applauds jared_c's effort :)

Wow, that's good work jared_c, well handled too!!

Greg

I edited the original post, and added how I was able to post in the AO Addicts forum. Web developers should take note of how this was done.

nice work man. i would give you some points but i dont think mine are worth anything yet though.

:george:

Too cool JC :cool:

Ah go on Jp he deserves to get into the Addicts forum, Ive always wondered what goes on in there....parties...? :)

Realy good ! !

jared_c and u r nearly there for real ! !

Greetings All:

I want to thank jared_c for the way he went about reporting this bug. It says a lot about him, and about the community that we have here at AntiOnline.

As for the problem, jared_c is right. We had the code in place for newreply and newthread, but weren't calling it correctly. Where I disagree with jared_c, is when he mentions to use a referer tag to make sure the form is being submitted from the site, and not from the user's local drive. Unfortunately, some browsers don't pass along the referer tag to the server, and some can actually be set up to fake the referer tags as well.

So, on our site, anything that needs validated, such as whether or not a user can post to the AO Addicts forum, is done via database queries. A quick lookup to see if the user's post count is greater than or equal to the total number of posts necessary to reply to the AO Addicts Forum, does the trick.

Thanks again to all that helped with this matter, and especially to jared_c!

Bug Fixed, Thread Closed!