zRainbow Dash
Forum Addict
add me on skyp pls.
Tribot alternative auth server (unofficial, with VIP)
- Thread starter yumxuidu
- Start date
msg me on syth pls.
Or you can contact me on IRC. I'm on networks Undernet, Freenode, Rizon, Coldfront, as "ss23".
I don't like Skype.
So I had a question about learning how someone would do this kind of thing for themselves (that is, take Tribot and make this style of crack for it). Thought I would post it here, in case anyone else was wondering about it.
-----
Learning this kind of stuff is a little weird, since normally you don't just need like... "learn SQLi" or anything, but rather you need a small amount of knowledge of all web stuff. So like, for this, knowing basic web security isn't really enough, since I needed to figure out how to find SSL certificates that would authenticate (which is largely a Java specific thing), then the knowledge for capturing and decoding encrypted requests, etc etc.
So basically, it's hard to give a single resource, but working with lots of different systems for a lot of times gives you a lot of experience, which is exactly what you need. You don't need to be particularly awesome at everything, just being able to kind of thing about problems and recognize things you could do to help, almost.
However, I can recommend a few places to learn the kind of thinking you end up using for anything like this (and more generally, it applies to every kind of programming and security). Places like http://io.smashthestack.org/ are amazing for learning how to think (and also if you're interested in security on the client side, no web stuff). Stripe, https://stripe-ctf.com/, ran the most amazing web CTF I've ever seen (the 2.0) one, which was awesome. There are lots of other places that run kinds of CTFs which are a great way to learn both specific skills, and the thinking you need to approach problems like this. Just pick some that seem fun.
-----
Learning this kind of stuff is a little weird, since normally you don't just need like... "learn SQLi" or anything, but rather you need a small amount of knowledge of all web stuff. So like, for this, knowing basic web security isn't really enough, since I needed to figure out how to find SSL certificates that would authenticate (which is largely a Java specific thing), then the knowledge for capturing and decoding encrypted requests, etc etc.
So basically, it's hard to give a single resource, but working with lots of different systems for a lot of times gives you a lot of experience, which is exactly what you need. You don't need to be particularly awesome at everything, just being able to kind of thing about problems and recognize things you could do to help, almost.
However, I can recommend a few places to learn the kind of thinking you end up using for anything like this (and more generally, it applies to every kind of programming and security). Places like http://io.smashthestack.org/ are amazing for learning how to think (and also if you're interested in security on the client side, no web stuff). Stripe, https://stripe-ctf.com/, ran the most amazing web CTF I've ever seen (the 2.0) one, which was awesome. There are lots of other places that run kinds of CTFs which are a great way to learn both specific skills, and the thinking you need to approach problems like this. Just pick some that seem fun.
The Zerker
Member
- Joined
- Mar 14, 2010
- Sythe Gold
- 0
- Messages
- 52
Thanks for this, it is great for when Tribot is down or just the fact that Trilez and friends have made 30k+ off the bot yet can't seem to find the time to develop anti-randoms so they don't deserve anymore money =p
"scripts"? Explain what you mean. No one here has any chance of being able to give you help with such a pathetic description of problems.
When I start a script, it gives me errors about how the source in unknown.
Oh that sucks. Good thing you gave us enough information to find out what the issue is though.
The issue is you're an idiot.
https://github.com/ss23/tribot-authentication/issues/4
If anyone was wondering why this was down, it's because it's been DDoS'd (multiple times) and the host has blackholed it until the attack has subsided.
I guess someone is mad that I'm cheating Trilez out of $5.
If anyone was wondering why this was down, it's because it's been DDoS'd (multiple times) and the host has blackholed it until the attack has subsided.
I guess someone is mad that I'm cheating Trilez out of $5.
- Joined
- Sep 4, 2005
- Sythe Gold
- 2,625
- Messages
- 6,379
Why would you bump this old thread?
And what problem are you talking about?
Make a thread asking about it at the TriBot forums and I'm sure someone will help you.
That is probably not the best idea.. unless you want to get banned.