Hacking a website's ratings ~ [Fun with Firebug]

[Robert1995]

if($input=>6){ $error = 1;

}

[Domthedude001]

@Robert1995 lol "5.999"

or "-100000000000000000"

[Robert1995]

Depending on the sites security... Basically your putting in a value that was not intended by the programmer... and modern programmer will build their PHP script to only accept 1, 2, 3, 4 or 5 and not except anything more than 6.

[sarxin]

This will desipere after clicking f5.

[Domthedude001]

@sarxin Wrong. it sends an edited value to the server and changes on the server, and the change is shown when you refresh (hit F5), and on any computer, anywhere.

[TehGIGAgamer]

@Domthedude001 Yes, i also know something else, if you are on a site with user profiles, then you must edit something that is not editable and when you click on ''save profile settings'' or whatever it is, it must be sent to the server. If all that is true, then edit a value, click the ''save profile settings'' button, and you have a value out-of-range of the normal values! For example: You can shout at user's profiles. The options to display shouts are: 3,6 and 9. Edit one however u like!

[itouchvideos8]

For those who think that you can just give this video 5 trillion stars, don't get excited. This obvious method only works on very unsucure sites.

[staggy916]

ohhh please. JS or Server side script can prevent this sort of "hacking" - which is exactly what would be implemented if the website owners gave a shit.

[Domthedude001]

@staggy916 JS couldn't prevent this.

[staggy916]

@Domthedude001 are you kidding me? An onSubmit event could validate the value is below 5 and stop the posting of the form. If JS is turned off, then just having some condition in the serverside script (php or alternative) could throw it out; if ($_POST['rating']>5) { echo "GTFO"; exit; }. Less than a minutes work to stop this happening.

[Domthedude001]

@staggy916 Yeap, serverside scripts can prevent this. I'd take out an onSubmit event in a second with Firebug though. JS validation is useless.

[getakshat]

cool :P

[Anggiclassicerz]

luv the song!

[saioshari]

movie theaters only this way u can make it right

[MoeBedard]

I'm a web designer who's continuously renewing my website every day to get more traffic. Check out the video Free Web Design Tools on my channel. I give a small tutorial on several free web design tools such as firebug, filezilla, and html color coder, plus many more!! All of the tools in my tutorial are essential tools that every web designer should have from a novice to expert level.

[diegofg10]

HAHAH GOOD

[crazymonkey186]

wats the website name caus its hard to find sites like this

[MikkelMunk2]

@faroukdabash i think is speeded up

[blacksword98]

do u need firefox

[MikkelMunk2]

@blacksword98 Yes

[hackerdudemofo]

@MikkelMunk2 it works with google chrome too

[TechMyWay]

ya i know what u mean... i already dabble in keylogging and viruses but recetly ive been getting into script

[gamerdtf555]

u should change the music to madworld ( even though it doesnt match this )

[allyourcode]

how about less distracting music; and using the available audio to explain what you're doing instead of using really lame text

[Heckytorr]

Guys who are whining about him not having 'hacked' the website but only stored the changes locally :

Yes, the element on the website that he changed, the star ratings, did not change, but the changes he made allowed him to submit an illegitimate rating to the website, and so changing it.

Anyway.

Nice one, another way of doing this would have been to use the program 'TamperData' to intercept the information it send.

[Domthedude001]

Thanks for clearing that up.

[diveshmai]

go slow man

]

[AcidAlchamy]

Loved it Dom haha.

[bluedove2897]

Ok Thanks

[No0bTEk]

it all goes way to fast.

[djh3mp]

Hmm.. i wonder if you could give a youtube video 100 stars with this!

[somepoeplejustsuck]

Nicely done mate :-) This is why never ever rely on POSTs and check them also.

[SpamfuckingRox]

i tried this and had similar problems to the others. How do i submit the data if i find one of these websites??

[holycornwolf]

yea thats actually a good question. How does the editing done save? Ive tried similar but it never worked.