Well I just figured out the admin thing on Labmonkey's game by having the source and sending the guild name packet
| Mirage Source http://miragesource.net/forums/ |
|
| Account Dupe Fix http://miragesource.net/forums/viewtopic.php?f=210&t=817 |
Page 1 of 2 |
| Author: | Matt [ Sat Dec 09, 2006 7:20 pm ] |
| Post subject: | Account Dupe Fix |
Originally posted by GodSentDeath Originaly Posted By: Jobs This was made by Danny On server side in modServerTCP in the Code: ' :::::::::::::::::::: ' :: Login packet :: ' :::::::::::::::::::: add Code: ' Prevent Dupeing
For i = 1 To Len(Name) n = Asc(Mid(Name, i, 1)) If (n >= 65 And n <= 90) Or (n >= 97 And n <= 122) Or (n = 95) Or (n = 32) Or (n >= 48 And n <= 57) Then Else Call AlertMsg(Index, "haha you made a booboo!!!") Exit Sub End If Next i I figured this should be here. As it's actually something all games/engines need. |
|
| Author: | Acruno [ Mon Aug 11, 2008 7:53 pm ] |
| Post subject: | Re: Account Dupe Fix |
Sorry for the Necro, but what does this actually do? |
|
| Author: | GIAKEN [ Mon Aug 11, 2008 7:57 pm ] |
| Post subject: | Re: Account Dupe Fix |
It only allows certain characters for the person to use in their name. This needs to be done wherever there's an input for character data (guild, password, whatever) because you can easily get Access=4 or whatever you want with something like Name & vbNewLine & Access=4 and so on. |
|
| Author: | Matt [ Mon Aug 11, 2008 8:08 pm ] |
| Post subject: | Re: Account Dupe Fix |
With default Mirage, and in any game that has not added this fix, you can login with your username and password, for example: ID: MyName Pass: 1234 Then you can open the client again and login again, on the same account, by using this: ID: /MyName Pass: 1234 Again, and again. Dropping your items on one client, picking them up on another, then logging out with the empty account first. Then logging out on the account with all the items, saving all your duped, illgotten items, money, etc. ^_^ |
|
| Author: | GIAKEN [ Mon Aug 11, 2008 8:34 pm ] |
| Post subject: | Re: Account Dupe Fix |
Well I just figured out the admin thing on Labmonkey's game by having the source and sending the guild name packet
|
|
| Author: | Acruno [ Tue Aug 12, 2008 12:49 pm ] |
| Post subject: | Re: Account Dupe Fix |
Thanks, I understand now 
|
|
| Author: | Asrrin29 [ Tue Aug 12, 2008 1:56 pm ] |
| Post subject: | Re: Account Dupe Fix |
If you use MySQL, I don't think any of these injection type attacks would work. But is the account duping still present or does it depend on using ini files? |
|
| Author: | Matt [ Tue Aug 12, 2008 1:58 pm ] |
| Post subject: | Re: Account Dupe Fix |
Asrrin29 wrote: If you use MySQL, I don't think any of these injection type attacks would work. But is the account duping still present or does it depend on using ini files? I have no idea. Give it a try on your game. |
|
| Author: | Labmonkey [ Tue Aug 12, 2008 2:14 pm ] |
| Post subject: | Re: Account Dupe Fix |
you can sql inject lol, it was reposted by like 4 people. |
|
| Author: | Asrrin29 [ Tue Aug 12, 2008 5:45 pm ] |
| Post subject: | Re: Account Dupe Fix |
Labmonkey wrote: you can sql inject lol, it was reposted by like 4 people. I have some scrubbing code that cleans out injection methods whenever the server touches the database. It's not enough to prevent a dedicated hacker I suppose, but it gets rid of injection attacks through the client and packet architecture. |
|
| Author: | Joost [ Thu Aug 14, 2008 12:24 pm ] |
| Post subject: | Re: Account Dupe Fix |
Code: ' Prevent Dupeing For i = 1 To Len(Name) n = Asc(Mid(Name, i, 1)) IfNot (n >= 65 And n <= 90) Or (n >= 97 And n <= 122) Or (n = 95) Or (n = 32) Or (n >= 48 And n <= 57) Then Call AlertMsg(Index, "haha you made a booboo!!!") Exit Sub End If Next i Or If Not, not sure what the corect syntax is. But this is way neater. |
|
| Author: | Matt [ Thu Aug 14, 2008 12:26 pm ] |
| Post subject: | Re: Account Dupe Fix |
Joost wrote: Code: ' Prevent Dupeing For i = 1 To Len(Name) n = Asc(Mid(Name, i, 1)) IfNot (n >= 65 And n <= 90) Or (n >= 97 And n <= 122) Or (n = 95) Or (n = 32) Or (n >= 48 And n <= 57) Then Call AlertMsg(Index, "haha you made a booboo!!!") Exit Sub End If Next i Or If Not, not sure what the corect syntax is. But this is way neater. I think it'd be If Not Not 100% sure. Lol. I didn't write this code. |
|
| Author: | Lea [ Thu Aug 14, 2008 6:57 pm ] |
| Post subject: | Re: Account Dupe Fix |
|
|
| Author: | Acruno [ Thu Aug 14, 2008 7:32 pm ] |
| Post subject: | Re: Account Dupe Fix |
Dave wrote: LOL Just out of interest, why DOES putting in certain characters/strings have an effect? |
|
| Author: | Lea [ Thu Aug 14, 2008 7:36 pm ] |
| Post subject: | Re: Account Dupe Fix |
As for the /name thing I think it checks if the account is online before it cleans the string of "bad" characters. As for the admin = 5 thing, If you write "Name = " and let the person specifiy what comes after that... they can make it say, "Dave & VBNewLine & Access = 5" Then the file will look like this: Name = Dave Access = 5 See the problem?  SQL injections are similar. |
|
| Author: | Reece [ Thu Aug 14, 2008 10:40 pm ] |
| Post subject: | Re: Account Dupe Fix |
Dave wrote: As for the /name thing I think it checks if the account is online before it cleans the string of "bad" characters. As for the admin = 5 thing, If you write "Name = " and let the person specifiy what comes after that... they can make it say, "Dave & VBNewLine & Access = 5" Then the file will look like this: Name = Dave Access = 5 See the problem? SQL injections are similar. Can't you just check to see if "VbNewLine" is in the textbox? |
|
| Author: | Asrrin29 [ Fri Aug 15, 2008 12:58 pm ] |
| Post subject: | Re: Account Dupe Fix |
Exactly, this is also how you "clean" input data before submitting a query to a MySQL database. look for any characters that would cause this and remove it. I use cleaning code for all MySQL queries in my own game, and everyone should use this dupe fix to prevent people from injection attacks. I was actually just thinking about this exact comment, getting your name legally changed to this and watch as chaos erupts, lol. |
|
| Page 1 of 2 | All times are UTC |
| Powered by phpBB® Forum Software © phpBB Group https://www.phpbb.com/ |
|