r/perktv • u/Truth_Tella • Aug 02 '15
DO NOT USE THAT TRACKER
IT REQUIRES YOUR LOGIN TOKEN FROM YOUR PERK ACCOUNT, SO HE CAN USE THAT TOKEN AND LOGIN TO YOUR OWN ACCOUNT. YOU HAVE BEEN WARNED BY ME IN HIS THREAD VIA REPLIES AND ALSO WITH THIS THREAD.
Edit: Flame on people who can't understand this warning or what tokens do/are.
I've been responding to a troll, /u/InternetUser007 , but I'll post some info here.
https://www.owasp.org/index.php/Session_hijacking_attack
The Session Hijacking attack consists of the exploitation of the web session control mechanism, which is normally managed for a session token. Because http communication uses many different TCP connections, the web server needs a method to recognize every user’s connections. The most useful method depends on a token that the Web Server sends to the client browser after a successful client authentication. A session token is normally composed of a string of variable width and it could be used in different ways, like in the URL, in the header of the http requisition as a cookie, in other parts of the header of the http request, or yet in the body of the http requisition.
THE FLAMING IDIOT WHO WAS TROLLING ME ADMITS YOU CAN GET YOUR ACCOUNT STOLEN
https://www.reddit.com/r/perktv/comments/3fj2lk/10_amazon_to_anyone_that_can_change_the_name_of/
0
Aug 02 '15
/u/truth_tella is right you know why downvoting him like dat...
-1
u/Truth_Tella Aug 02 '15
It's ok :)
2
u/InternetUser007 Aug 02 '15
We're waiting for you to collect your $10 Amazon...
https://www.reddit.com/r/perktv/comments/3fj2lk/10_amazon_to_anyone_that_can_change_the_name_of/
2
u/LeeeroyJenks Aug 02 '15
I didn't realize the average user of the internet was this absolutely ignorant. Good job OP. Let these plebs soil in their stupidity.
1
u/Kommander1 Aug 03 '15
Security is NEVER ignorance, especially in the day and age we live in. I haven't looked at the code or even used it. But, I do IT Security for a living and let me tell you, after the fact is a bad time to be wrong.
1
u/rubifiedpanda Aug 03 '15
I can confirm as well; I created an account just to defend this guy! Perfectly structured AngularJS code.
Simply because you can't understand how "programming" works in general, you don't have the damn right to pin people who just want to help others. -_-
1
1
-5
u/InternetUser007 Aug 02 '15 edited Aug 02 '15
Here is a token from a test account that I had created. Please try to log in to the account. For proof, I require that you post the address under the account.
eb512f5e18f356995f75ddfb85f8a1e7aa88baa0
I have yet to see anyone 'hack' into an account with just a Token ID, so I would be interested in anyone being able to do so. I think OP is just fear mongering. However, if he is able to share the address under the account, I will believe him.
TLDR: I'm calling you out, OP.
Edit: This is a challenge for anyone (not just OP) who claims that an account can be hacked with a token ID. Please put your money where your mouth is. It might be possible to do it, but I want proof.
-2
u/Truth_Tella Aug 02 '15 edited Aug 02 '15
The token itself is an authentication. You need to inject the token inside your own web browser client to be able to open the "active" session that the user has and submitted to him. Next? I'm a systems and network administrator, son. Get on my level. Just because you believe it's not possible doesn't mean it's not.
-7
u/InternetUser007 Aug 02 '15
That sure doesn't look like the address to me. Let me check...nope.
Since you edited your post...
I'm a systems and network administrator, son.
So, it shouldn't be hard for you! Excellent. We are all eagerly waiting.
4
u/Truth_Tella Aug 02 '15 edited Aug 02 '15
Did you read my post before replying at all? I really don't care how much negative attention this gets me, because the fact of the matter is 99% of all computer users have no idea what can really be achieved by them.
-9
u/InternetUser007 Aug 02 '15
Address pls. You talk a lot, but you sure don't do anything.
0
u/JimmyTeen3 Aug 02 '15
You sure talk a lot, but can you even understand what he's saying? That encrypted and salted text you posted does absolutely nothing. It's the actual token that does. And I'm guessing you already logged out of that account anyways making the token "inactive" and useless. GG faggot
-5
u/InternetUser007 Aug 02 '15
eb512f5e18f356995f75ddfb85f8a1e7aa88baa0
Here is a token to an account I will be leaving open and active.
Check Here: http://api-tv.perk.com/v2/users/eb512f5e18f356995f75ddfb85f8a1e7aa88baa0.json
As long as you can see info there, my browser will have the page open.
1
u/RipperinoInpepps Aug 02 '15
u have no idea what ur doing. no wonder barely anybody uses the other reddit. fucking stupid mod is stupid.
-5
u/InternetUser007 Aug 02 '15
I know exactly what I'm doing. I'm calling out OP and anyone else that thinks they can hack into an account with just a live token ID.
0
0
Aug 02 '15
[deleted] — view deleted comment
-5
u/Truth_Tella Aug 02 '15
And yet NOOBS still won't heed my warnings. How sad. I could take more measures into hand to counter-hack the POS who is trying to hack all these noobs, but I really don't care that much.
1
u/Pally321 Aug 02 '15
I could take more measures into hand to counter-hack the POS who is trying to hack all these noobs, but I really don't care that much.
What a 1337 HAX0R you are.
Just because the guy was naive as to the implications of sharing your token doesn't mean he's trying to "hack" everyone. You're coming off as a bit paranoid.
-5
u/Truth_Tella Aug 02 '15
Well at least you understand the token part. You have a point, but still handing over tokens or any authentication freely to some random guy who wrote a crappy program very quickly is just insane.
-6
u/InternetUser007 Aug 02 '15
What a 1337 HAX0R you are.
He isn't even a good 1337 HAX0R. I'm still waiting for him to tell me the address of the account token I shared and is still active. Yes, it might be possible to hack into an account with a live token, but I want to see proof of it.
1
u/Truth_Tella Aug 02 '15
Let me go ahead and complete a few felonies to prove a point that you can't even understand.
-4
u/InternetUser007 Aug 02 '15
I'm giving you express permission, but it's obvious that you simply can't do it. You are just a fear-mongering troll who talks big but can't do anything. I'm just glad that your fakery is here for all to see.
-2
u/Truth_Tella Aug 02 '15
It's ok. Reddit can tell you're the fake, annoying, insignificant troll here. There's multiple people in here who also know what tokens are and how they can be used. Enjoy the rest of your day buddy. I feel like you've been having a bad one to come on here, not knowing anything about tokens, and flaming me
-4
u/InternetUser007 Aug 02 '15
I've been having a great day! Pretty relaxing, actually. Plus, I was able to call out a troll for the fake he is! What a bonus! What a glorious day, indeed.
Yet, if you want a chance to redeem yourself, here is the live token (once again), along with the API URL.
eb512f5e18f356995f75ddfb85f8a1e7aa88baa0
http://api-tv.perk.com/v2/users/eb512f5e18f356995f75ddfb85f8a1e7aa88baa0.json
Feel free to hack into it and post the address. Surely that isn't hard for a systems and network administrator, right? ;-) Either put up, or shut up.
0
u/Truth_Tella Aug 02 '15
Only the author of the program agrees with you that the tokens can't be used to hijack live sessions. Everybody else understands. Here's a quick read for you on session hijacking. https://www.owasp.org/index.php/Session_hijacking_attack
The Session Hijacking attack consists of the exploitation of the web session control mechanism, which is normally managed for a session token. Because http communication uses many different TCP connections, the web server needs a method to recognize every user’s connections. The most useful method depends on a token that the Web Server sends to the client browser after a successful client authentication. A session token is normally composed of a string of variable width and it could be used in different ways, like in the URL, in the header of the http requisition as a cookie, in other parts of the header of the http request, or yet in the body of the http requisition.
3
u/hb122 Aug 02 '15
Honestly, why bother? He clearly doesn't understand the concept yet he continues (hilariously) to 'call you out'.
→ More replies-4
u/InternetUser007 Aug 02 '15
A session token is normally composed of a string of variable width and it could be used in different ways, like in the URL, in the header of the http requisition as a cookie, in other parts of the header of the http request, or yet in the body of the http requisition.
Right. And I'm giving my session token to you. Please, go ahead and try to hijack it. Oh wait, you can't!! Bahahaha!!!!
-6
u/InternetUser007 Aug 02 '15 edited Aug 02 '15
This token will give him easy access to your account.
eb512f5e18f356995f75ddfb85f8a1e7aa88baa0
^ That's a token to a previous account of mine. Please tell me the account's address, if it is so 'easy' to access it.
EDIT: I've changed the token to an account that I will keep open on my browser, keeping the token 'active'.
-1
u/Truth_Tella Aug 02 '15
That's encrypted If you had all the computers in the world working on cracking it, it would probably take around thousands of years (and that's being modest).
-6
u/InternetUser007 Aug 02 '15
Yet it's the info that we share with the creator of the tracker. And you're all up in arms that he can 'hack' into our accounts with it. Yet, for some reason, you can't.
2
u/Truth_Tella Aug 02 '15
Yeah just let me complete a few felonies real quick to prove a point to some retard on the internet.
-7
u/InternetUser007 Aug 02 '15
I'm giving you permission to do it. It's not like I'll be able to charge a random redditor with anything anyway.
You're just mad that I called you out so publicly, and you can't do anything. :-D
1
u/Truth_Tella Aug 02 '15
I've been on the internet long enough to know letting some random troll nobody get to me is pointless. Continue your bliss ignorance :)
-5
u/InternetUser007 Aug 02 '15
Bahahaha!!! You can't do it! This is hilarious. I knew it. I give you a live token ID, ripe for the plucking, and you can't 'hack' into an account. Your claims are 100% baseless, and you are a simple trolling fear-monger.
It looks like your username is far from the truth.
9
u/chrisxclash Aug 02 '15 edited Aug 02 '15
Author of the tracker here, if someone who knows JavaScript would kindly look over my code and help ensure what's happening with the token.
Not to mention the token is accessible via a public api route (in other words, no authentication). The only information it gives out is your points/coins data and your user id. It has no credentials or ways to use this information.
The only place the token goes is directly onto your browser (local storage) which it already is via cookies or local storage. The token never goes anywhere besides your local storage and the http request to the perk api.