This is probably the last one (yeah, finally – I’m sick of talking about CSRF too) then I’ll hopefully post the whole talk finally :) Hiding the CSRF with a popunder The 2013BH tag links to all posts related to my recent Blackhat EU talk I gave in March. There are probably a lot of techniques here, but there are two options I explored, using a popunder, and just making the window jump around/hard to close. How do we CSRF things that have X-Frame-Options enabled so we can’t use frames? We can always open a window, but a big popup isn’t really ideal. With some of the OAuth attacks from the last few posts, the identity providers did all in fact enable x-frame-options. With OAuth, protecting against UI redressing is even in the spec, so just creating a frame to do all your sneaky stuff won’t really work. It's that simple.X-Frame-Options is becoming more and more common. You can also use the bookmarklet way by going to and pasting the code into the big box then by clicking generate you covert the code to a bookmarklet so then go to the output box and copy the converted code and save it as a bookmark and go to Prodigy and excute the script by clicking on it. Use the command Control+Shift+I to access the console. DO NOT USE ANY OF THESE HACKS ON YOUR MAIN ACCOUNT, OR YOU MAY RISK YOUR ACCOUNT BECOMING IRREPERABLY BUGGED OUT, PREVENTING YOU FROM PLAYING THE GAME USING THAT ACCOUNT. THESE HACKS MAY OR MAY NOT BREAK YOUR ACCOUNT. We've already broke seven accounts! Disclaimer Be warned, if you mess up the data TOO much, the server gets really confused, and your account is broken forever! Don't do this on your main account. The server just manages multiplayer battles, and hosts data, messages, and events.īasically any changes you make to will save. Instead of handling everything server side, a lot of the heavy lifting is done on the player side.
I'm making this repository to try to get the developers to change how Prodigy handles player game data. Anyone who claims that we are 'malicious' or 'ruining the game', are wrong. By finding exploits, we help the developers find that there is an exploit, and the developers fix it, overall helping the game.
This may look like we're trying to ruin the game, but we're helping make it better. Notice: We are NOT trying to ruin Prodigy Math Game.
0 kommentar(er)
