so cookie toj website use to authenticate user is called tetirs [sic!].
it looks somehow like this:
- Code: Select all
SjIwMjE5NgJXb2p0ZWsCNjgCMAIwAjI2NTECMjAxMC8wNS8xOCAwOjAwOjAwAjIwMTAvMTEvMTQgNzoyMDoyMAJ1c2VyXHBlcnNvbkltZ1x0aHVtYlxwcm9maWxlX21fMS5naWYCMQIwAjACMAIxAjEwAjACaGFyZGRyb3AuY29tAjECNjdUTw==
when you decode it as base64 (first you need urldecode it, i think) you get something like this
- Code: Select all
J202196Wojtek680026512010/05/18 0:00:002010/11/14 7:20:20user\personImg\thumb\profile_m_1.gif10001100harddrop.com167TO
so where is auth token? there is none. all you need to do is change userid (in this case 202196) encode it back and you are authenticated as another user. you can find other's user userid by viewing their profile on website.
after you do this, you can do basically everything user can do, launch toj client with their accout, read their pw, but items for tp/coins, play unlockable flash games, view private user accout info. only thing you can't do is to view/change user's email and change password.
interesting thing is that TF also have similiar session handling issues, i reported them and they fixed it a bit and they even tried to workaround problem, but never bothered to fix it (afaik).
