Stupid question probably xD

Jaapii · Post by **Jaapii** » Thu Jan 10, 2008 5:01 pm

I have a lil' stupid question ^^
I see some topics with names like: Hacked due to Rev6, Rev6 hacked me
but I checked out the website and I only see some server stats and player stats, nowhere there is a way to hack someone
Can some1 tell me where it is? the hacking part?
I am not planning to hack someone xD I'm just curious :)
I hope someone will help this noob xD
Thnx

Alterran · Post by **Alterran** » Thu Jan 10, 2008 5:03 pm

the problem was fixed a while ago somewhere around november and it as takin of the rev6 web site

Jaapii · Post by **Jaapii** » Thu Jan 10, 2008 5:05 pm

thnx for answering,
but still curious xD
can you msg it to me? xD
Still, I am NOT planning to hack someone ^^

___ONLY___ · Post by **___ONLY___** » Thu Jan 10, 2008 5:10 pm

i have to dissapoint you, the bug isnt workin anymore
no free gear for you young man

Jaapii · Post by **Jaapii** » Thu Jan 10, 2008 5:12 pm

haha thnx :)
I am not disappointed :)
I was just curious but when it doesn't work anymore
it's not interesting anymore so ^^
Thnx though

NuclearSilo · Post by **NuclearSilo** » Thu Jan 10, 2008 5:21 pm

It's their own fault but ppl dont admit that. They need someone to blame, u know?

glavie · Post by **glavie** » Thu Jan 10, 2008 6:23 pm

Taken directly from there website

[Silkroad Exploit Step 1 out of 2]

[Joymax account exploit Part 1]
http://www.joymax.com/portal/
- Create a new account

Go on the following link: [Here]
Complete the E-mail Verification Service.

When you are done.

Log out.
Go on http://www.joymax.com/portal/
Go in the Forgot your password
Write your ID and E-mail
click Change Password

Now before clicking on Send verification code:
Exploit Step #1 start here:

http://rev6.com/AccountName.jpg

[Tool used do modify the account]

FireFox: [Here]

FireFox Addons: [Here]

Menu: Tools/Web developper/Forms/Display Form Details
Menu: Tools/Web developper/Forms/Enable auto completion

You will see the hidden variable UserID="YourAccountName"
You need to type the account name of the guy you want to steal he's account.

When it's done, click on [Send Verification Code]

You will receive an Email, click on the link on that email
It will ask for the code that was in the email write it and click confirm.

It will now ask for a new password
Fell free to do a
Menu: Tools/Web developper/Forms/Display Form Details
You will see that the account name that joymax send you is not your account name
But the target account name that you want to steal he's account.

Type the desired password and the First step is done.

Now you can go on
http://www.joymax.com/portal/
Type the password of the account you just stolen and you can look at he's personal setting on Joymax.com.

This is the step 1 of 2.
For security reason we won't release the step 2.

The Website password of the target account had changed to the password you have entered on Joymax.com
Now the 2nd step is to modify the Silkroadonline.net password to the Joymax password.
To change he's account password...

We will let joymax a 24-48 hours delay before posting how it's done.
If joymax doesn't nothing, everything will go Public.

In other word you can Steal someone else, legit or bot account with ONLY THE ACCOUNT NAME!.
I have wasted 42 hours investigating Joymax website.
Joymax fell free to compensate me for my time by using the donation link on the left.

May I add to this that the server Tibet All the high level have been hacked 1 by 1 using this glitch during the last 2 weeks.
Please note this goes against Joymax TOS and Joymax is fully responsible for this error. You will need to do a rollback and to do a compensation event for the time lost.
We Rev6.com did not used this exploit, we were investigating this error based on many user complaints.
Our community reported this anomaly and our objective is to persuade you that you must do a rollback
This mainly affected Tibet server, as for other server, please verify your bug report section.

I would like to thank all the anonymous tips received by many different users.
Joymax, if you read your Bug report, you will find how the entire Account stealing process from just an account name to empty the account on silkroad inside the game.

Sincerely,
C-o-r-E, MuMeD
And you’re friendly Venice Silk Assistant,
NeDra (also known as [GM]NyMbLe)

Rev6 was trying to help, but people like to whine a lot, and just look for a scapegoat.

Alterran · Post by **Alterran** » Thu Jan 10, 2008 6:30 pm

this really shouldnt have been posted because someone who is smart might find another way to do this so please delete it

destructionmama · Post by **destructionmama** » Thu Jan 10, 2008 6:34 pm

Jaapii wrote:haha thnx
I am not disappointed
I was just curious but when it doesn't work anymore
it's not interesting anymore so ^^
Thnx though

For some reason, you sound fishy to me...

because you are not interested anymore after you found out it doesn't work anymore....

seems like you are planning to do something if it still works...

... no offense...

XMoshe · Post by **XMoshe** » Thu Jan 10, 2008 6:35 pm

Alterran wrote:this really shouldnt have been posted because someone who is smart might find another way to do this so please delete it

He deleted the most important links as far as I can see...but who knows

Naigasakis_Rebirth · Post by **Naigasakis_Rebirth** » Thu Jan 10, 2008 7:17 pm

nah that method is patched but im sure ppl are workin on a new one

glavie · Post by **glavie** » Thu Jan 10, 2008 9:33 pm

XMoshe wrote:
Alterran wrote:this really shouldnt have been posted because someone who is smart might find another way to do this so please delete it

He deleted the most important links as far as I can see...but who knows

I didn't mean to delete the links lol. But whatever, anyway that is only part 1 which is all that was released to the public anyway. There was a part 2 released on the botting forums, but before I could try it they patched the web site. Then denied the whole thing ever happened. Joymax's denial was the final straw, I quit playing for a month. They will never get money from me again.

Malicious · Post by **Malicious** » Thu Jan 10, 2008 9:42 pm

Naigasakis_Rebirth wrote:nah that method is patched but im sure ppl are workin on a new one

+1

So everyone should try to secure their account as much as possible.

glavie · Post by **glavie** » Thu Jan 10, 2008 11:21 pm

Malicious wrote:
Naigasakis_Rebirth wrote:nah that method is patched but im sure ppl are workin on a new one

+1

So everyone should try to secure their account as much as possible.

I think the real point is that securing your account isn't good enough, the best thing to do is have multiple accounts. Unfortunately for the few people here who don't bot, it is kind of difficult.