MOD-Zippy hacked!

[Kent]

and Heidster used some crap about a new quest starting so habbos security didn't look as crap as it actually is.

[dannyisnotamazing]

dont go on websites when your on habbo

..only Habbo addicts would do that. "/.

Just to come on the net to use Habbo only, no other sites lmao. :S

Habbo can fix the XSS flaw if they try..

[Invent]

Go on Habbo.co.uk, in the address bar paste: javascript:alert(document.cookie);

The "hacker" gets that sent to his email. He can use the JSSessionID to get into your account.

[Never]

Go on Habbo.co.uk, in the address bar paste: javascript:alert(document.cookie);

The "hacker" gets that sent to his email. He can use the JSSessionID to get into your account.

How's that send it to his email?!

edit: o ya dont matter.

[Invent]

Some things in Habbo allow you to specify the data in say an input form by doing "?formname=">+javascript code" or something, lol.

[Never]

Oh interesting...

How would Habbo patch this?

[Jam]

Oh interesting...

How would Habbo patch this?

bobba It Knowing Them! Lol, Nice Find.

[Niall!]

bobba It Knowing Them! Lol, Nice Find.

LOLOLOL

Im gonna be a little more carefull from now on

But not be a habbo addict and not visit sites lolol

[Bill]

Both of those MOD's signed my guestbook.


habbo.co.uk/home/bill

[timROGERS]

It's very easy to patch, just filter the input for the GET variables What I don't know is how the session ID is gonna help them to touch your account.