Cutenews - Don't use it

[Moh]

But you wouldn't be able to get the password. That's what elliot means.

Most of the news team are there just to post news, and may use dictionary words.

[Invent]

Well it doesn't really matter. It takes 2minutes to get the password and then you can forge the Cutenews session and mess up their site.

[Moh]

Well it doesn't really matter. It takes 2minutes to get the password and then you can forge the Cutenews session and mess up their site.

Whos site?
The person whos trying to get into the cutenews, or the targets?

[Invent]

The person that's trying to get into the Cutenews.

I've just tried the technique now and I'm in ClubHabbo's Cutenews panel
I've logged out now though as I'm nice

Good Evening SkaterChu

Some stats
System SelfCheck Active News 115
Can write to news.txt Yes Postponed News 0
Can write to postponed_news.txt Yes Unapproved News 0
Can write to unapproved news Yes Active Comments 1098
Can write to comments.txt Yes Archives 0
Can write to users.db.php Yes Users 1
Can write to archives dir Yes

aha

You are now logged out, login

[Decode]

What if your pw was antiestablishmentarianism? :8

Well then he wouldnt even need to hack it because you just posted the password.

[AgnesIO]

If uy have sence you would make you're pword summin like:
0fe9654f

[Lee]

How Do You do It?

[Moh]

To prevent people from using this script, remove search.php :p


There may be another way though

[Ini]

What is th point in this..

If people want to use cutenews, let them.

[Moh]

What is th point in this..

If people want to use cutenews, let them.

Reason:
http://habbcrazy.net/Demo/getusers.php

Will display all the users, so you know the usernames.
There should be 3 users listed. Use another code to get the md5 hash.

-------
Username: Test
Hash: http://habbcrazy.net/Demo/test1.php
-------
Username: Test2
Hash: :http://habbcrazy.net/Demo/test2.php
-------
Username: Test3
Hash: http://habbcrazy.net/Demo/test3.php
-------

You can then use them md5 hashes and reverse them:
http://gdataonline.com/seekhash.php

If you reverse the md5, you should now be able to login with one of them user names here:
http://habbcrazy.net/Demo

Edit: May not work is some 1 changes passwords.