Me Paranoid ?

[Rizze Profile Website]

Did anyone read into what I posted, anyone connect the dots?
Not funny you know, I am being quite serious.

But this is

Has your penis got a face...thats not funny, thats serious rizze....

Seriously can you explain for dummies, Im good with the hardware but shite with software and programming

Yes anyone with the right script can get your e-mail and ip from your posts, without them replying to your said post by using a similar script such as this.

Code: Select all

if request.POST:
    current_user = users.get_current_user()
    u = models.user_test.User.get_or_insert(current_user.user_id())
    u.email = request.POST.get('email', current_user.email())
    u.save()
    return http.HttpResponseRedirect('/user/settings')

And the user I pointed out user_test_csrf

If you read my first link you may get an idea.

browserscope

[Perry LaGuardia Profile]

Shit Rizze, you are right, its not funny and its more than joining the dots....

[Kinninigan Profile]

i clicked on the link you gave rizze.....WTF is going on??????


..and why does it do that to my profile......

[Zan Profile]

Now I remember, it was a DTV mail.

You can see the difference in time from when i registered and when I got the mail.

You mean she doesn't have good news for me?

[Zan Profile]

I think there are 2 things going on.

user_test_csrf
CSRF stands for 'cross site request forgery' which is an attack that tries to get the user to execute code on their system by clicking on a link. The link looks normal on the web page but is actually structured to do something naughty. There's a good explanation of it here. http://en.wikipedia.org/wiki/Cross-site_request_forgery User_test_csrf is way to obvious a user name to think it is being used for that purpose unless your server admin is actually testing CSRF on DTV. Which I think is probably the case and should definitely be checked out with the admin.

btrendbaby
Is some sort of scam but you actually have to email them. If you search 'btrendbaby' on Google she pops up on a lot of dating sites and the romantic DTV. The troubling part about this is that whoever is doing this has a way of getting new user names. They then send an email like the one I got from btrendbaby's DTV profile hoping to hook someone. User shaden27, derekyoung902, and user_test_csrf all have a message from her because these are accounts created in the last few days like mine.

They don't necessarily have to penetrate the server deeply to get the user names. If they were able to do a directory traversal of http://www.disclose.tv/members/action/myprofile/ and compare it to a scan they did the day before they would have the user name of everyone new that signs up. There are a number of ways to see if that is the case that the server or network admin should be able to provide.

[Zan Profile]

:ohno:
i clicked on the link you gave rizze.....WTF is going on??????
..and why does it do that to my profile......

That's not your profile.

I got half a star.

How did that happen?

[Disclosetv]

I have a theory of what may prove critical to DTV members.

I know a small amount about scripts and how to use them to get information, Today whilst browsing new members, I saw something very familiar to me, it was a word that is used in scripting for webmasters and hackers.
So I delved a bit deeper and found this browserscope a part of this script can be used to get user names, e-mail and ip addresses.

The keyword for here is user_test_csrf
What do you think, anyone here know if I am right or just a bit paranoid.
Do you think there is some foundation to this theory of mine?

user_test_csrf is a test user of our developers for testing our "ANTI-HACKING" measurements. CSRF = Cross-Site Request Forgery.

So, no worries, but thanks anyways. Could have been something sinister.

Lukas
Disclose.tv Site Admin

[Spock Profile]

Awesome news! That was the initial hope when this thread was opened. Thanks for the confirmation!

[domdabears Profile Website]

Like a boss