Jump to content

Java (L2J) sql Injection


Recommended Posts

http://forum.xenus-m.com/showpost.php?p=3440&postcount=1

 

 

 

Original text:

 

 

 

 

 

Java:

 

 

 

Injection:

 

UPDATE `characters` SET `access_level`=200 WHERE `char_name`='ИМЯ' - ты админ

 

UPDATE `npc` SET `exp`=900000000 WHERE `name`='Имя' - 75 лвл

 

 

 

Дюп:

 

1. Даешь нубу А то что хошь дюпнуть.

 

2. В боте выбираешь в меню Чар : Мануал....логинимся, после появления окошка выбора персов жмем логаут, но эт окошечко не закрываем

 

3. Опять же в меню Чар: №чара А и заходим в игру... (то окошко висит все еще)

 

4. Кидаем чаром А трейд запрос чару Б. Ложим в окно трейда то что хотим

 

дюпнуть и жмем чаром А кнопку ОК (чаром Б ниче не жмем)

 

5. Юзаемс то окошко от Мануал Селекта и через него не выходя опять заходим чаром А, типа по идее тут клон делался... на яве не делается

 

6. Подтверждаем сделку персом Б. В итоге на персах А и Б то что дюпнули.

 

7. С перса А передаем все персу Б...на персе Б шмота становиться в 2 раза больше.

 

З.Ы.(Если вы сразу положите дюпнутый шмот с перса Б обратно персу А, то после релогина у перса А пропадет дюпнутый шмот...то есть пункт 7 делать обязательно)

 

З.Ы.(Если вы сразу положите дюпнутый шмот с перса Б обратно персу А, то после релогина у перса А пропадет дюпнутый шмот...то есть пункт 7 делать обязательно).

 

 

 

Стопка:

 

1.Идеш в магазин

 

2.Нажимакш на покупку стрел

 

3.Открываеться меню ввода количества, пишеш например 10, И НЕ НАЖИМАЕШ ОК!

 

4.Опять открываеш магазин и выбираеш нужное оружие!

 

5.Оружие нужно просто выделить - 1-н раз нажать!

 

6.Нажимаеш ок на меню где вводил количество стрел!

 

7.Выходит вы покупаете десять вещей в одной

 

8.Дальше просто точите!

 

9.Потом когда заточите!

 

Идите в ВХ и ложите ету вещь и ждете рестарта сервака, все.

Link to comment
Share on other sites

http://forum.xenus-m.com/showpost.php?p=3440&postcount=1

 

 

 

Original text:

 

 

 

 

 

Java:

 

 

 

Injection:

 

UPDATE `characters` SET `access_level`=200 WHERE `char_name`='ИМЯ' - ты админ

 

UPDATE `npc` SET `exp`=900000000 WHERE `name`='Имя' - 75 лвл

 

 

 

Where should I put this maxtor?

Link to comment
Share on other sites

Injection:

 

UPDATE `of characters `OF SET `of access_level `of =200 WHERE “char_name `= ' NAME” - you [admin]

 

UPDATE `of npc `OF SET `exp `of =900000000 WHERE “name `= ' name” - 75 [lvl]

 

Of [dyup]:

 

1. You give [nubu] A the fact that you [khosh] to [dyupnut].

 

2. In the boat you select in the menu of the charms: [Manual]….[loginimsya], after the appearance of a window of the selection of Persians we harvest they [logaut], but [et] aperture we do not shut

 

3. , in addition in the menu of the charms: №[chara] A also we go in the game… _ (the window hang still)

 

4. We throw by [charom] A of [treyd] demand to [charu] b. We lie down into the window of [treyda] the fact that we want

 

to [dyupnut] we harvest by [charom] A button ok (by [charom] B to [niche] we do not harvest)

 

5. [Yuzaems] the window from [Manual] Of [selekta] and through it without leaving again we go by [charom] A, type according to the idea here clone was done… in Java it is not done

 

by 6. We confirm transaction by Persian b. As a result on the Persians A and B the fact that of [dyupnuli].

 

7. From the Persian A we transfer entire to the Persian B…on the Persian B of [shmota] to become 2 times more.

 

Z.Y.(If you immediately place [dyupnutyy] [shmot] from the Persian B conversely to Persian A, that after [relogina] in Persian A will disappear [dyupnutyy] [shmot]…i.e., point 7 to make compulsorily)

 

z.Y.(If you immediately place [dyupnutyy] [shmot] from the Persian B conversely to Persian A, that after [relogina] in Persian A will disappear [dyupnutyy] [shmot]…i.e., point 7 to make compulsorily).

 

Pile:

 

1.[idesh] into store

 

2.[Nazhimaksh] to the purchase of arrows

 

3.To [otkryvaetsya] the menu of the introduction of a quantity, [pishesh] for example 10, AND NOT [NAZHIMAESH] OK!

 

4.Again [otkryvaesh] store and [vybiraesh] necessary weapon!

 

5.Weapon must be simply isolated - is 1st once to harvest!

 

6.[Nazhimaesh] ok on the menu where introduced a quantity of arrows!

 

7.You leaves you buy ten things in one

 

8.Further simply you sharpen!

 

9.Then when you will sharpen!

 

Iditol in VKh you lie down [etu] thing and you await the restart of [servaka], everything.

Link to comment
Share on other sites

Injection:

 

UPDATE `of characters `OF SET `of access_level `of =200 WHERE “char_name `= ' NAME” - you [admin]

 

UPDATE `of npc `OF SET `exp `of =900000000 WHERE “name `= ' name” - 75 [lvl]

 

Of [dyup]:

 

1. You give [nubu] A the fact that you [khosh] to [dyupnut].

 

2. In the boat you select in the menu of the charms: [Manual]….[loginimsya]' date=' after the appearance of a window of the selection of Persians we harvest they [logaut'], but [et] aperture we do not shut

 

3. , in addition in the menu of the charms: №[chara] A also we go in the game… _ (the window hang still)

 

4. We throw by [charom] A of [treyd] demand to [charu] b. We lie down into the window of [treyda] the fact that we want

 

to [dyupnut] we harvest by [charom] A button ok (by [charom] B to [niche] we do not harvest)

 

5. [Yuzaems] the window from [Manual] Of [selekta] and through it without leaving again we go by [charom] A, type according to the idea here clone was done… in Java it is not done

 

by 6. We confirm transaction by Persian b. As a result on the Persians A and B the fact that of [dyupnuli].

 

7. From the Persian A we transfer entire to the Persian B…on the Persian B of [shmota] to become 2 times more.

 

Z.Y.(If you immediately place [dyupnutyy] [shmot] from the Persian B conversely to Persian A, that after [relogina] in Persian A will disappear [dyupnutyy] [shmot]…i.e., point 7 to make compulsorily)

 

z.Y.(If you immediately place [dyupnutyy] [shmot] from the Persian B conversely to Persian A, that after [relogina] in Persian A will disappear [dyupnutyy] [shmot]…i.e., point 7 to make compulsorily).

 

Pile:

 

1.[idesh] into store

 

2.[Nazhimaksh] to the purchase of arrows

 

3.To [otkryvaetsya] the menu of the introduction of a quantity, [pishesh] for example 10, AND NOT [NAZHIMAESH] OK!

 

4.Again [otkryvaesh] store and [vybiraesh] necessary weapon!

 

5.Weapon must be simply isolated - is 1st once to harvest!

 

6.[Nazhimaesh] ok on the menu where introduced a quantity of arrows!

 

7.You leaves you buy ten things in one

 

8.Further simply you sharpen!

 

9.Then when you will sharpen!

 

Iditol in VKh you lie down [etu] thing and you await the restart of [servaka], everything.

 

 

 

 

 

 

 

 

 

 

 

if someone could make a new translation because cant understand anything maybe i ll test it and see if it really works............

Link to comment
Share on other sites

lol noob

 

 

 

 

 

 

 

 

 

a haaaa you finished your exams in junior high school (gimnasio) and you came back to the forum to write your ............. again???

 

 

 

F F S

 

 

 

 

 

 

 

P.S AN SE PETIXO POUTHENA THA SOU SPASO TO KEFALI

Link to comment
Share on other sites

  • 1 month later...
  • 2 years later...

translate 1st post

Dupe

 

1. give to newbie A what you wanna dupe.

 

2. in bot choose Char: Manual . logging, when appear  select char window press logout, but dont close window

 

3. again in char menu: #of char A and enter in game (other window in background)

 

4. char A make trade request to char B. put in trade windo duping item, press "ok" in char A window, in char И window dont press anything

 

5. in window with manual select, without exiting, enter with char A; smth like clone. on java not work.

 

6. approve the trade in char B window. summary bota char A and B have duped item.

 

7. from char A trade to char B item and char B have double item.

 

p.s. if you put dupped item from B to A then after relogin dupped item is disappear.

 

Link to comment
Share on other sites

Stackable

 

1. go to  shop (weapon)

 

2. choose buying an arrows

 

3. in quantity window write 10 for example and DONT press an Ok button

 

4. again open the shop window and chose a weapon

 

5. weapon must be just selected - pres only 1 time

 

6. press ok in quantity  of arrow window

 

7. it smth like you buy 10 items in 1

 

8. so just enchant

 

9. when enchant, go to warehouse and store this item in your WH and wait for restart of sever. thats all

 

Link to comment
Share on other sites

  • 2 months later...

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.



  • Posts

    • Well, sorry not sorry for resurrecting old topic, but I believe it's ultimately stupid to implement license checks like Vilmis did 🙂   private static String url = "jdbc:mysql://185.80.128.233/" + getData("Zm9ydW1fZGI="); private static String username = getData("bXJjb3B5cmlnaHQ="); private static String password = getData("Y29weXJpZ2h0XzEyMw=="); con = GlobalDB.getInstance().getConnection(); PreparedStatement statement; statement = con.prepareStatement("SELECT field_6 from core_pfields_content WHERE member_id = ?"); statement.setInt(1, Config.FORUM_USER_ID); ResultSet rset = statement.executeQuery();   This awesome way of coding things leaves us with base64-encoded credentials and DB exposed and accessible globally 😉 Btw he checks his licensing data from some plugin generated table his forum uses. Vilmis took action and ensured that mrcopyright user would have only needed accesses and rights for this operation. But he forgot to ensure that his INFORMATION_SCHEMA database would not be exposed and readable... That leads us to fully readable server variables like version used (10.1.26-MariaDB-0+deb9u1 - pretty ancient DB and OS, I'd assume). From here you can go south and do some kinky stuff, if you want and have knowledge for that. But who cares, right?   Ooh, table core_pfields_content field_6 is IP address which is checked by FORUM_USER_ID. Yep, you can query all IP addresses there (124 of them right now) and also do whatever you want with them! 🙂  The most fun part? Files source has been shared what, more than 2 years ago?  Vilmis still uses very same credentials and never changed it after sources exposure - who cares. Although, "sources" may be way too strong word here. If anyone still use paid Orion versions, I'd suggest packing your shit and leaving immediately, or at least fix this incompetent fool caused problems. It's obvious Vilmis don't care or maybe doesn't even know from the first place how to solve this problem (hint hint - tiny PHP Rest API microservice which would do absolutely the same but without exposing sensitive data?). By doing that, he exposes his infrastructure and YOUR data, and he does that for more than 2 years now 🙂 Developer of century!    
    • rename the l2.bin into l2.exe
    • L2LIVE.PRO- Dynamic Mid-rates Essence Seven Signs GRAND OPENING - July 5, 20:00 GMT+3 (EEST) TEST SERVER IS OPEN - COME AND CHECK IT OUT TODAY! Join our community and be part of it at: https://www.l2live.pro https://discord.gg/k3NMgR4Dmu   Server description * EXP/SP: Dynamic (x1- x100 based on your level, *before* Sayha and EXP buffs * Adena: x50 / Item Drop: x10 / Fishing EXP increased / Attribute EXP increased * Simplified gameplay to stay in the loop while not spending hours and hours farming * Starter Pack containing very useful items for beginners * MP replenishing potions with auto-consumption * No overpowered donations L2LIVE shop * All spellbook coupons, pet spellbook coupons and master books are sold via Game Assistant * Additionally you can buy SP pouches, enchanted talismans, pet training guides and various other consumables for Adena and L-Coin * More items such as cloaks, more talismans, agathions, belts, pendants, enchantment scrolls of various grades, evolution stones, etc will be added! Shop server as a shortcut, and all retail-like ways of earning items are still here! L-Coins * Drops with small change and in random amounts from Lv60+ monsters  * All raidbosses drop random amount of L-Coin Pouches generating up to 420 Lcoin per unit. **Grand Olympiad and Events** * Grand Olympiad is held week day * Format is 1v1, unlimited weekly fights  * Heroes are declared weekly at Sunday * There are three automated events - TvT, CTF and Deathmatch, running at evenings * Orc Fortress, Battle with Balok, Keber Hunter, Archievements Box, Daily Gift Calendar provisional events are active too Custom user commands * .offlineplay command, your character will keep playing till death or server restart * .offlineshop command, keeps your shop sitting until all items are purchased * .apon / .apoff - enable/disable HP/MP autoconsume And lots of other small improvements are waiting for you!   Join our community and be part of it at: https://www.l2live.pro https://discord.gg/k3NMgR4Dmu
  • Topics

×
×
  • Create New...