mods dont care about your safety, and the forum is compromised

[Romxnus753AC]

i ran a controlled scraping test on my own account to see how the forum holds up against automated data collection. Wanted to share the results because they're not great

What we did: used a real browser session (my own, logged in), attached an automation tool to it, and let it go through the search results like a normal user browsing
(the script logged itself without human help which cloudflare should have detected )

First attempt got hit by the Cloudflare captcha, which is expected
Second attempt went through without any captcha at all. The browser session was already "trusted" by Cloudflare, so the script just kept going.
It pulled the full search history of one test account (mine) every thread, post, timestamp, forum ~900 records in a few minutes. No rate limit no block or resistence

The point isn't that we scraped our own data. The point is that if i can do it, anyone can do it on everybody here with one script(which i programmed) The forum currently doesn't stop automated traffic once a session is trusted, and that's a problem for everyone's data, so @Master and other mods need to update this forum, end points could be exposed, if i probabily dig i will find them, just update the forum or WE will lose all our data to some random hacker

so do this=
Update XenForo to the latest version (there are known CVEs fixed in 2.3.13+ that we should be on)
Configure Cloudflare WAF properly rate limiting bot management, not just the initial challenge
Add server side detection for abnormal browsing patterns (pageperfew-seconds, no mouse events, etc.)
Review what user data is actually exposed in search results and whether it needs to be

Not trying to fearmonger Just saying: we tested it, it worked way too easily, and we should fix it before someone with worse intentions does the same thing.

pictures:

for example this is my recent data scrapped, everything i posted is in the database, pictures, links, addresses, (ofc my own)

(if you ban me again, ur just exposing ur users to threats and its illigal)

 

[Erdafritnib]

End of the world

 

[Absurdist]

bump

 

[Romxnus753AC]

End of the world

well if u care about ur stuff yea

 

[hopelessmanlet32]

TLDR
forum is made like shit

 

[Romxnus753AC]

TLDR
forum is made like shit

just tell @Master to update the end points are probabily exposed this fat retard spends time w clavicular but does not care this forum

 

[Nectar]

Unpopular opinion: He should also hand us the ability to delete our threads too rather than us pm’ing to ask them

 

[Romxnus753AC]

Unpopular opinion: He should also hand us the ability to delete our threads too rather than us pm’ing to ask them

the threads u delete still are in their database

 

[Romxnus753AC]

bump

 

[Nectar]

the threads u delete still are in their database

Also jfl at some users thinking deleting your account as a whole gets rid of every post ik some do this then realise they r fucked

 

[TGUN.]

Do u not have other issues to care about

 

[Romxnus753AC]

Also jfl at some users thinking deleting your account as a whole gets rid of every post ik some do this then realise they r fucked

well if mods refuse to acutally delete the user info, you can yk do it urself if u get what i mean

 

[Romxnus753AC]

Do u not have other issues to care about

no i want my older threads wiped off their database, and if they dont do it after i asked them ill do it myself

 

[loneiqlet]

i ran a controlled scraping test on my own account to see how the forum holds up against automated data collection. Wanted to share the results because they're not great

What we did: used a real browser session (my own, logged in), attached an automation tool to it, and let it go through the search results like a normal user browsing
(the script logged itself without human help which cloudflare should have detected )

First attempt got hit by the Cloudflare captcha, which is expected
Second attempt went through without any captcha at all. The browser session was already "trusted" by Cloudflare, so the script just kept going.
It pulled the full search history of one test account (mine) every thread, post, timestamp, forum ~900 records in a few minutes. No rate limit no block or resistence

The point isn't that we scraped our own data. The point is that if i can do it, anyone can do it on everybody here with one script(which i programmed) The forum currently doesn't stop automated traffic once a session is trusted, and that's a problem for everyone's data, so @Master and other mods need to update this forum, end points could be exposed, if i probabily dig i will find them, just update the forum or WE will lose all our data to some random hacker

so do this=
Update XenForo to the latest version (there are known CVEs fixed in 2.3.13+ that we should be on)
Configure Cloudflare WAF properly rate limiting bot management, not just the initial challenge
Add server side detection for abnormal browsing patterns (pageperfew-seconds, no mouse events, etc.)
Review what user data is actually exposed in search results and whether it needs to be

Not trying to fearmonger Just saying: we tested it, it worked way too easily, and we should fix it before someone with worse intentions does the same thing.

pictures:View attachment 5713067View attachment 5713066

for example this is my recent data scrapped, everything i posted is in the database, pictures, links, addresses, (ofc my own)

(if you ban me again, ur just exposing ur users to threats and its illigal)

Mr robot over here

 

[Amuzant]

i ran a controlled scraping test on my own account to see how the forum holds up against automated data collection. Wanted to share the results because they're not great

What we did: used a real browser session (my own, logged in), attached an automation tool to it, and let it go through the search results like a normal user browsing
(the script logged itself without human help which cloudflare should have detected )

First attempt got hit by the Cloudflare captcha, which is expected
Second attempt went through without any captcha at all. The browser session was already "trusted" by Cloudflare, so the script just kept going.
It pulled the full search history of one test account (mine) every thread, post, timestamp, forum ~900 records in a few minutes. No rate limit no block or resistence

The point isn't that we scraped our own data. The point is that if i can do it, anyone can do it on everybody here with one script(which i programmed) The forum currently doesn't stop automated traffic once a session is trusted, and that's a problem for everyone's data, so @Master and other mods need to update this forum, end points could be exposed, if i probabily dig i will find them, just update the forum or WE will lose all our data to some random hacker

so do this=
Update XenForo to the latest version (there are known CVEs fixed in 2.3.13+ that we should be on)
Configure Cloudflare WAF properly rate limiting bot management, not just the initial challenge
Add server side detection for abnormal browsing patterns (pageperfew-seconds, no mouse events, etc.)
Review what user data is actually exposed in search results and whether it needs to be

Not trying to fearmonger Just saying: we tested it, it worked way too easily, and we should fix it before someone with worse intentions does the same thing.

pictures:View attachment 5713067View attachment 5713066

for example this is my recent data scrapped, everything i posted is in the database, pictures, links, addresses, (ofc my own)

(if you ban me again, ur just exposing ur users to threats and its illigal)

nigga found out what inspect element is


This is all @pony 's fault.
That faggot needs to be raped.

@0ogrpostcel understands this, it is natural to want to do this to pony. Especially when pony consumes jewish media.

 

[Romxnus753AC]

Mr robot over here

blud

 

[Sett]

sudo apt install opsec

 

[Romxnus753AC]

nigga found out what inspect element is


This is all @pony 's fault.
That faggot needs to be raped.

@0ogrpostcel understands this, it is natural to want to do this to pony. Especially when pony consumes jewish media.

nigga found out what inspect element is


This is all @pony 's fault.
That faggot needs to be raped.

@0ogrpostcel understands this, it is natural to want to do this to pony. Especially when pony consumes jewish media.

Not inspect element i used a real browser session with chrome debugging attached to an auto framework It navigated the search pages like a normal user, pulled every result (title, author, date, forum, link,etc) and saved them to a local database. No HTML editing or dev tools console The browser was already logged in and trusted by Cloudflare, Inspect element shows you only the page u are inspecting

 

[TGUN.]

no i want my older threads wiped off their database, and if they dont do it after i asked them ill do it myself

Fair enough ngl

 

[Amuzant]

Not inspect element We used a real browser session with chrome debugging attached to an auto framework It navigated the search pages like a normal user, pulled every result (title, author, date, forum, link,etc) and saved them to a local database. No HTML editing or dev tools console The browser was already logged in and trusted by Cloudflare, Inspect element shows you only the page u are inspecting

i dont get it whats wrong with that

 

[0ogrpostcel]

nigga found out what inspect element is


This is all @pony 's fault.
That faggot needs to be raped.

@0ogrpostcel understands this, it is natural to want to do this to pony. Especially when pony consumes jewish media.

What does this even mean

You want to rwpe pony you little fag

 

[Romxnus753AC]

i dont get it whats wrong with that

a bot did it(script) thats the problem, the site defense system (cloudflare) didnt block, flag or report me, and i scrapped everything, if could have done this with user passwords , names etc, this happens because most probabily the forum end points are exposed, and if the end points are exposed u can inject scripts to do dirty worl

 

[Amuzant]

What does this even mean

You want to rwpe pony you little fag

it isnt rape if you wear protection, pony would more than likely enjoy it regardless. Espically if it was both of us.

You are still a virgin if you have never had sex without a condom - goatis

 

[Amuzant]

a bot did it(script) thats the problem, the site defense system (cloudflare) didnt block, flag or report me, and i scrapped everything, if could have done this with user passwords , names etc, this happens because most probabily the forum end points are exposed, and if the end points are exposed u can inject scripts to do dirty worl

Try it with emails, and send me my email in pms. Im curious on how this works.

 

[0ogrpostcel]

it isnt rape if you wear protection, pony would more than likely enjoy it regardless. Espically if it was both of us.

You are still a virgin if you have never had sex without a condom - goatis

Mirin quote

But stop with this gay shit

 

[Romxnus753AC]

Try it with emails, and send me my email in pms. Im curious on how this works.

sure, what do you want i send be more specific, you want the script to dm you without i do anything?, explain more

 

[Amuzant]

Mirin quote

But stop with this gay shit

i hate pony and i will overcome his moderation position once my account is old enough.

 

[buccalfatremoval]

That nigger doesn’t care

 

[Amuzant]

sure, what do you want i send be more specific, you want the script to dm you without i do anything?, explain more

i can tell youre romanian or some foreign speaker. I have no idea what youre trying to say.

 

[AscendHQ]

Fr niggas will steal my data abt how I will start a Afghan revolution

 

[muhajudin21]

the threads u delete still are in their database

so im fucked?
dude my futures employers can not find this out

 

[AutistKhan]

eVen privet messages?

 

[Romxnus753AC]

i can tell youre romanian or some foreign speaker. I have no idea what youre trying to say.

im italian, anyway i said to explain better what you said because i didnt get what you said by "Try it with emails, and send me my email in pms. Im curious on how this works." you want me to send the forum users emails to you? with the script?

 

[Romxnus753AC]

so im fucked?
dude my futures employers can not find this out

well for them its illigal to show what you did here without ur permissions unless u did something illigal urself

 

[Amuzant]

im italian, anyway i said to explain better what you said because i didnt get what you said by "Try it with emails, and send me my email in pms. Im curious on how this works." you want me to send the forum users emails to you? with the script?

oh i didnt understand your post. I thought you meant you can find out specific users details using a bot. and i was wanting you to send me my email as proof it works.

 

[muhajudin21]

well for them its illigal to show what you did here without ur permissions unless u did something illigal urself

what abt government jobs?

 

[Romxnus753AC]

oh i didnt understand your post. I thought you meant you can find out specific users details using a bot. and i was wanting you to send me my email as proof it works.

AHHH no i just did scrapping, scrapping means simply taking everything online about you in a site or forum ur in, you it finds user specific users details using a script but i dont know if u meant secretive ones or public ones

 

[Romxnus753AC]

what abt government jobs?

they will know about this forum if ur email is connected to this forum, police, cia,fbi, the army, thats ifthey care tho

 

[AutistKhan]

@

what abt government jobs?

Nigga talking about tretinoids which only doctors can prescribe it is illegal so its over

 

[AutistKhan]

@5ft2cutecel This is what Im talking about

 

[0ogrpostcel]

@

Nigga talking about tretinoids which only doctors can prescribe it is illegal so its over

Tretinoid is not illegal?

 

[AutistKhan]

Tretinoid is not illegal?

Its prescribed only drug and if you tell someone to use it its illegal

 

[Romxnus753AC]

bumppp

 

[sørenyuko]

Just dont share personal information then

What's so bad about this

or is there something im missing?

 

[Romxnus753AC]

Just dont share personal information then

What's so bad about this

or is there something im missing?

the something ur missing is that since the forum uses a older xenforo version some end points could be exposed and since i used this scrapping tool (i could have used something far worse) a bot bypassed security and scrapped all my data

 

[5ft2cutecel]

@5ft2cutecel This is what Im talking about

Wowq I dnr tyo fwn u explain

 

[Romxnus753AC]

Wowq I dnr tyo fwn u explain

 

[5ft2cutecel]

View attachment 5713194

I dnr tho can u explain

 

[Romxnus753AC]

I dnr tho can u explain

the forum xenforo (software) used in the site creation as a older version, and this older version does not have some fixes the new version has, this means that some end points are probabily exposed, and thru end points you can gain access into admin pannels etc , important stuff