Pentesting Services Needed

BlackVikingPro
8 years ago | edited 8 years ago

0

Good evening! I have halfway finished a new project I’m working on for my UIL Computer Science group/club, which would be a website section that gives us options to live chat, send pms, and much more. Well, I’ve finally implemented AES 256 bit encryption for security and everything :). Well, I now want to give it a shot at how well my security really is, I myself couldn’t find any loopholes, but you know me well right @dloser :D. Anywho, I’d really like it if people can give it a shot for me, please be responsible! I will give you guys URL’s to signup and signin, please respect that it’s still in development and will have several bugs.

I don’t log IP’s until you create a new account, that’s it though. Other than that, Google’s reCaptcha system might (I would assume they do). This data is secured, and will be deleted on request. Please don’t input any personal data! I am not responsible for data leaks (in case you do put in your real password/email), so just don’t. All information gathered by my services will NOT stick around, as soon as I get back to these forums, I will verify and delete the information!

Thanks, good luck ;)

web addresses:
Login: https://www.blackvikingpro.com/uil/accounts/login.php
Signup: https://www.blackvikingpro.com/uil/accounts/dev_docs/signup/

4i3V86mohOtXKBEBeo4IdGUpd7n34XWWiKubImOTYDdkQUHIG3x1i2bUt3lKJiXXWAEUG3sm5bZNNUj31kC3Du==

Where is Caesar when you need him?

SIGKILL [r4v463]
8 years ago

0

[quote=BlackVikingPro]I’ve finally implemented AES 256 bit encryption for security and everything[/quote]

Just to be sure, you’ve not implemented AES256 by yourself, you’ve used an already existing implementation ?

b1nary
8 years ago | edited 8 years ago

0

and the access code is ??
EDIT: oh unless u expect us to bypass it ? i guess i missunderstood the task then

f0rk [HackingGuy]
8 years ago | edited 8 years ago

0

I don’t know if error handling is the best… It took about 5 whole mins to return this load:
https://www.blackvikingpro.com/uil/accounts/login.php?p=-&escape^;‘;;^’-%00dev_docs/signup?username=test&password=test

I just was messing around. This post has no meaning.

There’s no place like 127.0.0.1

cn9 [1337boy]
8 years ago

-1

last time OP tricked everyone in finding vulnz and then to report everyone to the police for hacking
so fuck off.

WaRWolFz crew

f0rk [HackingGuy]
8 years ago

0

What R ur wordz xD
R U Frl?

There’s no place like 127.0.0.1

Reply has been removed

SIGKILL [r4v463]
8 years ago

0

Concerning the brute-force attack, if in “letters” you include both lower and upper case, you have a 62 char alphabet (2 alphabets and the 10 digits) , with a 10 to 12 password length, you have (6210 + 6211 + 62**12) which is +/- 3e21 possibilities.

So even if we consider 1 million IP adresses, each one makes 10 attemps, there is a probability of 1/(3e21/(1e6*10)) ie 1/3e14 that the password is the good one.

Obviously this calculation doesn’t consider the fact that maybe the password is something like “Bl4ckV1k1ng” which will be find easily with a dictionary attack.

Reply has been removed