So "HQ", what happened?

[Magnea]

In this thread will I, togehter with my friend HippeN present some information and perhaps something entertaining too, but
to start with I want to say that we don't take any responsibility for what's happening when you use these bugs. It could be everything
from bans to a "knock-knock" visit from Sulake.

So, what is it?
This started in the Swedish hotel, since me and HippeN are from Sweden. We created a group where we let people who had a possible value
for "bug spotting" join. In the end we had a list with about 20 bugs. We took this list, about six months ago and sent it to the Swedish hotels safety
manager "VincentViga". With the list I also sent a film, showing how to use one of the bugs.

I received a letter containing a thank you where he also told me he sent it to the HQ in Finland to work on a solution to this.
Time passed, new versions came. An update for the Habbo Homes? Not a sign of it.

That's why we decided, 3-4 versions later to set a bit of pressure on Sulake and present the bugs, with instructions here at the forum.
Hopefully a solution will be presented by Sulake and we receive some credit for solving problems which can be used quite seriously.

What is needed?
Firefox, Tamper data (addon) and Firebug (addon), which is the tools we use.

-----------------

# BUG ONE. Add user to your group #

Now, you might wonder what we mean by adding a user to your group.
Well, the Habbo groups uses a kind of input-field when you accept a members-application for your group.

This input-data is possible for us to edit, with the help of Firebug, and then post the data to their servers.
And, easy as that, you may have a staff member or two in your group.

So, this is how you do it: (Requires: Firefox and Firebug)

* Go to your group, click to the list with waiting members.
* When you are here, activate Firebug by clicking the little bug in the statusbar of Firefox.
* Now, a field will pop-up at the lower part of your browser. Press Inspect.
* Hold the mouse over one of the names. Click when a blue window pops-up around the name.
* Now, a piece of the code will be marked in the field below the Inspect-button. Search until you find a piece of code that looks similar to this:
"<input id="group-memberlist-m-0123456" type="checkbox" style="margin: 0pt; padding: 0pt; vertical-align: middle;"/>"

* Edit 0123456 to another ID. The first Habbo at your hotel will most probably have ID 1, but you can choose any Habbo you want.

-----------------

Hopefully we will be ready to release the next bug by tomorrow!

[Boxiel]

Very detailed, i'm sure they appreciate people like you putting this forward..

We should arrange something like this on UK, rather then a bunch of new users asking for furni in our "bugs/pilot" forums. :/

+rep for the effort

[HippeN]

Boxiel: Thank you for your input, we will do our best to update this thread as often as we can.
I dont know what Sulake think, but with a waitingtime that is around 6 months, its fair (to me..) publishing this list.

/H

[Earthquake]

Lmao thats pretty awsome, so you can actually put different people in your group without them even joining?!

[Magnea]

Lmao thats pretty awsome, so you can actually put different people in your group without them even joining?!

Exactly

[Earthquake]

Exactly

Lmao, thats pretty awsome glitch/bug! +rep

[Magnea]

# BUG TWO. Make a user send you a friends request without this person even knowing about it #

This isn't really a bug, more like a smaller hole that is possible to use in unintended ways.

So, how do you do it? Well, when you visit a habbo's home there will be a button, "Ask to become friend" (if the user accepts friendrequests!). The link used by this button is possible to manipulate and you can, because of that, for example with a 1x1 pixels large iframe, make sure that everyone who visits your link sends a friends request to you (or the habbo you chose...).

* You create a homepage in a language you choose, for example HTML and using Javascript, but it works with all languages.
* When you've done this, add a redirect to the following adress:
"http://www.habbo.se/myhabbo/friends/addAfterLogin?accountId=12345678"
* Replace 12345678 with yours or someone elses Habbo ID.
* When a user visits the page you created he will now be sent to the hotel homepage and send a friends request to the habbo you've chosen.

(Tip: Add it in a 1x1 pixels iframe and try to make a habbo-staff visit it, and you might find yourself have a friends request from a staff

EDIT: Delete this post, I was sure I clicked "Edit"...

[Magnea]

# BUG TWO. Make a user send you a friends request without this person even knowing about it #

This isn't really a bug, more like a smaller hole that is possible to use in unintended ways.

So, how do you do it? Well, when you visit a habbo's home there will be a button, "Ask to become friend" (if the user accepts friendrequests!). The link used by this button is possible to manipulate and you can, because of that, for example with a 1x1 pixels large iframe, make sure that everyone who visits your link sends a friends request to you (or the habbo you chose...).

* You create a homepage in a language you choose, for example HTML and using Javascript, but it works with all languages.
* When you've done this, add a redirect to the following adress:
"http://www.habbo.se/myhabbo/friends/addAfterLogin?accountId=12345678"
* Replace 12345678 with yours or someone elses Habbo ID.
* When a user visits the page you created he will now be sent to the hotel homepage and send a friends request to the habbo you've chosen.

Tip: Add it in a 1x1 pixels iframe and try to make a habbo-staff visit it, and you might find yourself have a friends request from a staff

[Samishlol]

What if you don't have or use firefox? Your pretty stuffed

[dbgtz]

How do you find out their id?