4 ms·

If I were that scammer I'd quickly see I can likley filter out all accounts added within such a short burst of time following convention of <name><number>@yaho

If I were that scammer I'd quickly see I can likley filter out all accounts added within such a short burst of time following convention of <name><number>@yahoo.com Also, my guess is most users don't have that pattern of password...

Dolores12 8y ago
filtered by IP and Useragent.
- iforgotpassword 8y ago
  Also seems some kind of ID is encoded in the URL he got redirected to after visiting the initial link, as well as the field names.
rad_gruchalski 8y ago
It would be probably another 5 minutes to add: random delay and a thread pool, a file with Xk most common passwords, random user agent from another file, bunch of email domains, select at random, append numbers to local part when ... [bunch of conditions]. Another half an hour to deal with the IP address stuff. But, I think the purpose of the video was to show how to use the requests library.
- DKnoll 8y ago
  How would you deal with the 'IP address stuff'? If you plan on harvesting SOCKS proxies or using existing lists, your adversary can just check IPs against DroneBL.
  - rad_gruchalski 8y ago
    Hey, I’m sure that video does not show how to build an anti-scammer solution. The scam stuff seems to be a nice back story for showing some python stuff. OTOH, any time a scammer is required to go and look at the data, write filters and what not, it’s a win!
    - DKnoll 8y ago
      True. It's interesting to look at from the other perspective though, normally we're on the side trying to prevent malicious users and in this thread we're thinking as the 'malicious' user.
legohead 8y ago
I thought the form fields were suspicious. The scammer may already have something in place that generates random user/pass form fields, and even random endpoints by the look of the url. The "engineer" didn't check this, which he could have easily done by simply refreshing the page. But if the scammer did have any sort of protection, the engineer would have had a lot more work in it for him, having to scrape the page.. so maybe he purposely ignored this red flag.
- jamra 8y ago
  I think he did check it and the video we saw was the fast version of this process for the sake of the viewer. But that’s just what my instincts tell me based on the time spent investigating, the amount of useful snippets, and the lack of typos and errors while coding.
- pavel_lishin 8y ago
  There's no need to put engineer in quotes. This video wasn't an in-depth how-to; it was just a quick proof-of-concept.
  - legohead 8y ago
    It wasn't meant as an attack. I don't know his name, but his channel is called engineer-something, so I meant it as "engineer-something". Although I do think, for a learning video, that he missed out on a lot of opportunity to explain such things as I mentioned.
- eat_veggies 8y ago
  I checked out the page myself, and the endpoints and form fields are the exact same for me. Also, there's some funny exposed PHP code sent along: <?php session_start(); ?> And some packed javascript that does nothing because it's "commented out" with  inside the <script> tags, meaning it has syntax errors.

Dolores12 8y ago

filtered by IP and Useragent.

iforgotpassword 8y ago
Also seems some kind of ID is encoded in the URL he got redirected to after visiting the initial link, as well as the field names.

rad_gruchalski 8y ago

It would be probably another 5 minutes to add: random delay and a thread pool, a file with Xk most common passwords, random user agent from another file, bunch of email domains, select at random, append numbers to local part when ... [bunch of conditions]. Another half an hour to deal with the IP address stuff. But, I think the purpose of the video was to show how to use the requests library.

DKnoll 8y ago
How would you deal with the 'IP address stuff'? If you plan on harvesting SOCKS proxies or using existing lists, your adversary can just check IPs against DroneBL.
- rad_gruchalski 8y ago
  Hey, I’m sure that video does not show how to build an anti-scammer solution. The scam stuff seems to be a nice back story for showing some python stuff. OTOH, any time a scammer is required to go and look at the data, write filters and what not, it’s a win!
  - DKnoll 8y ago
    True. It's interesting to look at from the other perspective though, normally we're on the side trying to prevent malicious users and in this thread we're thinking as the 'malicious' user.

legohead 8y ago

I thought the form fields were suspicious. The scammer may already have something in place that generates random user/pass form fields, and even random endpoints by the look of the url. The "engineer" didn't check this, which he could have easily done by simply refreshing the page. But if the scammer did have any sort of protection, the engineer would have had a lot more work in it for him, having to scrape the page.. so maybe he purposely ignored this red flag.

jamra 8y ago
I think he did check it and the video we saw was the fast version of this process for the sake of the viewer. But that’s just what my instincts tell me based on the time spent investigating, the amount of useful snippets, and the lack of typos and errors while coding.
pavel_lishin 8y ago
There's no need to put engineer in quotes. This video wasn't an in-depth how-to; it was just a quick proof-of-concept.
- legohead 8y ago
  It wasn't meant as an attack. I don't know his name, but his channel is called engineer-something, so I meant it as "engineer-something". Although I do think, for a learning video, that he missed out on a lot of opportunity to explain such things as I mentioned.
eat_veggies 8y ago
I checked out the page myself, and the endpoints and form fields are the exact same for me. Also, there's some funny exposed PHP code sent along: <?php session_start(); ?> And some packed javascript that does nothing because it's "commented out" with  inside the <script> tags, meaning it has syntax errors.