exp injector via hiscore page?

I just started thinking about mysql/php injection scripts, and it might just be possible to change the amount of exp you have via the runescape hiscore list.. if you ever noticed, it wont refresh while you play, it only refreshes when you logout. Anyways, does anyone have any creative ideas to get us started on a hiscore injector?

Also when browsing around looking for the script that calls the exp to be written to the page, turn off javascript. I just noticed this sneaky bit of coding:

Code:

<script type="text/javascript">
try {
var pageTracker=_gat._getTracker("UA-2058817-2");
pageTracker._setDomainName("runescape.com");
pageTracker._initData();
pageTracker._trackPageview();
}catch(x){}

</script>

 

Hmm.
I'm no expert on Php etc, but I will get my friend to look at this, as I think you could be onto something.
¬Albal

 

I'm more interested in the getDomainName part. I'm no professional coder, but wouldn't it be possible to create a replica, change your EXP and change the domain?

 

It just pulls your stats out of a database and puts them into a html table. It only updates when you log out to save on processing time I'd assume. There would be no way to edit those stats without access to the database, good luck finding it let alone cracking it.

 

I'm not sure. I think that the codes just saying that the trackers belongs to Runescape.com, or something along those lines. Like the Pirate Bay, or Demonoid, they use trackers to update your stats. Which it looks like what Jagex is doing with this code

Code:

var pageTracker=_gat._getTracker("UA-2058817-2");

Not entirely sure though.

 

it recieves the information, from a tracker. (database)

have a fun time cracking that.

 

First, how do sites like draynor.net make stat sigs? anyone have a similar script?

 

They just have a script that retrieves the info from the Hiscores. Just like Eliteswitch and Swiftswitch.

 

If you can get in touch with 3---hit---u, he might help you out. He assisted me with making sigs that used xp values awhile back.

 

Don't any of you guys know what that code is?

That's Google Analytics tracking code.

Almost every site has it. It has NOTHING TO DO with the HiScore page whatsoever.

I'm ashamed of you

 

I fell st00pid.



It would be nice, but all it does is same as stat sigs, it looks up the values and adds them in.
In stat sigs case, it looks up the high score table, and adds text onto an image with the variables they retrieved from a high score search.

The high score search does similar, but with a database you can bet your ass on that you can't crack it.
I'm not insulting you, I'm only saying they hire people to encrypt it DEEPLY, then hire better people to try to crack it and give advice on how to strengthen it.

You'd have to be uber l33t to access any data, or edit anything.
Not to mention not scared of prison for black hatting a video game.


"wut u du tu get hur/"
"I tried to hack mah runescape stats."

"ur mi3n tunite"

 

people crack warez all the time, anyways bump!

 

im sure Jagex would have protrection from SQL injection. And if they didn't you would still have to worry about how the values are written, which type of SQL, stuff like that. Also, as said before that code has nothing to do with high scores...