DarkerAds
BANNED
- May 1, 2023
- 568
- 1,040
UPDATE
So, total profit so far is under $10k.
Not as good as I expected, but it was 100% on autopilot so I'm not getting mad about free money.
Unfortunately, the journey ends here. The devs patched the vulnerability and can't be exploited any more.
So, I'm going to reveal what this exploit was all about.
For obvious reasons, I won't say the exact site/niche/url of the target as I could discover more vulnerabilities on their site so I won't give my possible-goldmine away
Basically, I usually I game around withdrawal forms/pages/scripts in crypto sites and they usually are well-guarded, but in this one site, I saw that the form accepted all kinds of values for withdrawals, even if I had 0 balance! Yeah, the dream!
So, I tested a lot and see why and how it worked and to my surprise, if I entered a malformed string (not a number) it would trigger something on the backend of the site and it resulted in me getting a few pennies in my crypto wallet while having 0 balance in the crypto site, brand new account, no deposit and I saw that this was profitable!
Sure, probably devs thought that no one would try to exploit a vulnerability that yields a few pennies at time, right? No one is dumb enough to create an account, verify it and submit the malformed string in the withdrawal form for pennies... hehe
And so, I started playing with the form and trying to see hwo much or how it worked to try to see if I could extract more pennies at a time.
Well, I found out that there was a small window of a few seconds that after submitting the form with the first malformed string and submitting another withdrawal form I could extract TWICE the amount of pennies each time! and obviously the withdrawal address I had the private key and could move the funds around and when I saw that I said BINGO!
Now, I had a vulnerability that I COULD extract value and after doing a research on their crypto wallets, they had a frw million $$$ so I thought that if I could automate this vulnerability, I could make big bucks!
Obviously, I tested this manually to see if it was not some kind of promotion or something like that, but after a few trials and getting convinced I was getting FREE money, I decided to start this thread, start the automation part and make some $$$.
I had to make lots of accounts and so I needed emails and so I remembered that there was somthing called "catch-all" emails and so what I did was set up a protonmail account and I set up a few domains and set up catch all with them. But then , I had to automate the reading of the verification url sent when creating an account, and so I used AI to help me set up a script in a server where it would read the incoming emails and detect the "verification url" of each account that I was going to create.
I used AI for this purpose and I think this is the part that woud have taken me a few weeks to set up as it's the first time I deal with emails, setting up the automation, reading the emails and making sure everything worked smoothly.
It took me a few days to set up pyppeteer, the domains for the catchall email addresses and the testing but I'm really astonished at how much AI helped in speeding up the set up. Without it, it would have taken me a few weeks to search all the needed info to get this up and running.
The first automation part
So, by this time, I started running the script on autopilot and man, the feeling of actually making money online on AUTOPILOT for the first time in my life, WAS INSANE!
I thought that there was few eyes on the lookout for anything suspicious from their end, but I didn't think it would be found that quick. It took the site's devs a few days what was happening and they suddenly patched it, momentarily.
Sheez, such a nice streak, but then I found that their patch had another vulnerability. This time I found that for some reason, if I entered an amount in scientific notation and I then urlencoded it, the withdrawal form would go through and the number in scientific notation would trigger the system to send me a few pennies. Unfortunately, the withdrawal amount was not the amoun in scientific notation, but it still worked.
Now, I don't understand why they let their form go through even when I had no balance. I guess no one tested the withdrawal form, or MAYBE, the "vulnerability" was set up by the devs themselves so they could profit off of the crypto site itself?
Eventhough I tried to stay under the radar, the first patch was installed and now it was time for the scientific notation method.
The second automation part
I had all the set up in pause mode and I just needed to make a few tweaks so I could submit the form with the new method I found.
Smooth sailing until a few hours ago from the time of this post.
Will I find a third vulnerability? who knows! (that's why im not sharing the url/site/name)
In any case, so far the profit was under $10k of FREE money.
Key takeaways:
- devs, CHECK your forms and how they are processed in your backend. the withdrawal form SHUOLD NOT be submitting if I had 0 balance
- blackhatters, test everything, you might find gold
- opsec is king. Without it, I wouldn't have dared exploit this vulnerability
- find a way to cashout anon. I converted crypto to XMR then I used P2P to cashout. Read about XMR attacks and how people have been deanonymized so you don't make those mistakes
- AI is great to speed up coding
The things that made it all possible:
- AI. Without it would have taken me a few weeks or days to set the automation part
- Technical knowledge. The part where I tested selenium and pyppeteer (to see which was better for my use case) + catchall email with proton + knowing RegEx and other small "details" allowed me to execute and automate this. The toughest part was pyppeteer as I had to find the exact xpaths and parts of the site where it had to enter the malformed string or urlencoded scientific notation amount as the ids and site structure changed with every new visit.
- Opsec and knowing how to cashout. Without knowing this, I would probably wouldn't even dare the execute as I would be too afraid to be caught. If I didn't know about this, I could have executed and then deposit the funds to my binance account directly but convert everything to XMR, use tor network and your own node, then use P2P exchanges to cashout. Read more about XMR possible attacks and opsec (like fee amounts, deposit/transfer amounts, timing, etc)
BIG Note: for opsec reasons, I changed a few things from reality so that if the owner of the site reads this the timeline, methods and more isn't the exact sime as what was executed
So, total profit so far is under $10k.
Not as good as I expected, but it was 100% on autopilot so I'm not getting mad about free money.
Unfortunately, the journey ends here. The devs patched the vulnerability and can't be exploited any more.
So, I'm going to reveal what this exploit was all about.
For obvious reasons, I won't say the exact site/niche/url of the target as I could discover more vulnerabilities on their site so I won't give my possible-goldmine away
Basically, I usually I game around withdrawal forms/pages/scripts in crypto sites and they usually are well-guarded, but in this one site, I saw that the form accepted all kinds of values for withdrawals, even if I had 0 balance! Yeah, the dream!
So, I tested a lot and see why and how it worked and to my surprise, if I entered a malformed string (not a number) it would trigger something on the backend of the site and it resulted in me getting a few pennies in my crypto wallet while having 0 balance in the crypto site, brand new account, no deposit and I saw that this was profitable!
Sure, probably devs thought that no one would try to exploit a vulnerability that yields a few pennies at time, right? No one is dumb enough to create an account, verify it and submit the malformed string in the withdrawal form for pennies... hehe
And so, I started playing with the form and trying to see hwo much or how it worked to try to see if I could extract more pennies at a time.
Well, I found out that there was a small window of a few seconds that after submitting the form with the first malformed string and submitting another withdrawal form I could extract TWICE the amount of pennies each time! and obviously the withdrawal address I had the private key and could move the funds around and when I saw that I said BINGO!
Now, I had a vulnerability that I COULD extract value and after doing a research on their crypto wallets, they had a frw million $$$ so I thought that if I could automate this vulnerability, I could make big bucks!
Obviously, I tested this manually to see if it was not some kind of promotion or something like that, but after a few trials and getting convinced I was getting FREE money, I decided to start this thread, start the automation part and make some $$$.
I had to make lots of accounts and so I needed emails and so I remembered that there was somthing called "catch-all" emails and so what I did was set up a protonmail account and I set up a few domains and set up catch all with them. But then , I had to automate the reading of the verification url sent when creating an account, and so I used AI to help me set up a script in a server where it would read the incoming emails and detect the "verification url" of each account that I was going to create.
I used AI for this purpose and I think this is the part that woud have taken me a few weeks to set up as it's the first time I deal with emails, setting up the automation, reading the emails and making sure everything worked smoothly.
It took me a few days to set up pyppeteer, the domains for the catchall email addresses and the testing but I'm really astonished at how much AI helped in speeding up the set up. Without it, it would have taken me a few weeks to search all the needed info to get this up and running.
The first automation part
So, by this time, I started running the script on autopilot and man, the feeling of actually making money online on AUTOPILOT for the first time in my life, WAS INSANE!
I thought that there was few eyes on the lookout for anything suspicious from their end, but I didn't think it would be found that quick. It took the site's devs a few days what was happening and they suddenly patched it, momentarily.
Sheez, such a nice streak, but then I found that their patch had another vulnerability. This time I found that for some reason, if I entered an amount in scientific notation and I then urlencoded it, the withdrawal form would go through and the number in scientific notation would trigger the system to send me a few pennies. Unfortunately, the withdrawal amount was not the amoun in scientific notation, but it still worked.
Now, I don't understand why they let their form go through even when I had no balance. I guess no one tested the withdrawal form, or MAYBE, the "vulnerability" was set up by the devs themselves so they could profit off of the crypto site itself?
Eventhough I tried to stay under the radar, the first patch was installed and now it was time for the scientific notation method.
The second automation part
I had all the set up in pause mode and I just needed to make a few tweaks so I could submit the form with the new method I found.
Smooth sailing until a few hours ago from the time of this post.
Will I find a third vulnerability? who knows! (that's why im not sharing the url/site/name)
In any case, so far the profit was under $10k of FREE money.
Key takeaways:
- devs, CHECK your forms and how they are processed in your backend. the withdrawal form SHUOLD NOT be submitting if I had 0 balance
- blackhatters, test everything, you might find gold
- opsec is king. Without it, I wouldn't have dared exploit this vulnerability
- find a way to cashout anon. I converted crypto to XMR then I used P2P to cashout. Read about XMR attacks and how people have been deanonymized so you don't make those mistakes
- AI is great to speed up coding
The things that made it all possible:
- AI. Without it would have taken me a few weeks or days to set the automation part
- Technical knowledge. The part where I tested selenium and pyppeteer (to see which was better for my use case) + catchall email with proton + knowing RegEx and other small "details" allowed me to execute and automate this. The toughest part was pyppeteer as I had to find the exact xpaths and parts of the site where it had to enter the malformed string or urlencoded scientific notation amount as the ids and site structure changed with every new visit.
- Opsec and knowing how to cashout. Without knowing this, I would probably wouldn't even dare the execute as I would be too afraid to be caught. If I didn't know about this, I could have executed and then deposit the funds to my binance account directly
but convert everything to XMR, use tor network and your own node, then use P2P exchanges to cashout. Read more about XMR possible attacks and opsec (like fee amounts, deposit/transfer amounts, timing, etc)BIG Note: for opsec reasons, I changed a few things from reality so that if the owner of the site reads this the timeline, methods and more isn't the exact sime as what was executed
