[Killpot]

Just tested and started debugging and oh my, such bad, much stupid.

PLEASE don't store configs in cleartext and locally.



What i recommend doing is everytime a user is registered, create a private key and store it inside a database, use any type of encryption you want. When a user connects initially to the program, it will send a request to the server with info like HWID and stuff, server sends back the key to decrypt the config file, which is then read by the program.

or you can simply store configs server side.

Though tbh you shouldn't stress that much on security for an account generator, its a desktop app which isn't used very frequently anymore and tbh its only an account generator, I believe you are stressing security way to much compared to adding original features, utilities and ideas.

Hmm, yeah I suppose I could do that, wouldn't be very hard, I don't see much of a flaw though, even though the password and username are stored in plain text on the client. So what? It's not compromising the server if someone gets his/her login from their own computer, like say a RAT, I'm not going to protect them from them selves. Really this isn't much, all you've done is just looked at the XML that's stored locally from settings, nothing groundbreaking. The only reason I can think of for encrypting the passwords client side, (Passwords are encrypted on the server), is to prevent Man in the middle attacks, but even then, that's going a little far.

//Edit//

Oh. I take that back. The password is hashed before it even leaves the client, I forgot about that. SSP3's client handling forces you to do so, it hashes the password with the keys, so eventually once users can specify their own keys it will be even more secure. I mean, I guess I could also make it so the client doesn't save the password, and they have to re-enter it every session, but again, it'd be more of an inconvenience than a security flaw.

[Coefficient]

TBH there isn't much to do except pentesting, not cracking. Since everything is stored server side, unless exploiting the requests and trying to request multiple accounts, I don't have the time to test that.

[Killpot]

TBH there isn't much to do except pentesting, not cracking. Since everything is stored server side, unless exploiting the requests and trying to request multiple accounts, I don't have the time to test that.

Execute to get cracked another day.

[TheTekBot]

Very nice, Thanks a lot for this

[Killpot]

Very nice, Thanks a lot for this

You're welcome, I hope you enjoy it!

[Killpot]

Testing stage is over, servers are shutting down.

[Killpot]

going to try this tool

Not a thing anymore, servers aren't online.

[Azzid]

Isn't this the same one that people were Turing into a malware as well?

[Killpot]

Isn't this the same one that people were Turing into a malware as well?

Huh? Not sure what you're talking about but this isn't malware. It's just a client and server connection using LiteCode and SSP3 along with some custom dependencies, I use it for almost all of my projects that I sell. All it did was ask the server for account credentials and the server does a few simple checks like cooldown checks and multiple IP checks then just feeds the client a response. That's really it, not very complex.

[Azzid]

Isn't this the same one that people were Turing into a malware as well?

Huh? Not sure what you're talking about but this isn't malware. It's just a client and server connection using LiteCode and SSP3 along with some custom dependencies, I use it for almost all of my projects that I sell. All it did was ask the server for account credentials and the server does a few simple checks like cooldown checks and multiple IP checks then just feeds the client a response. That's really it, not very complex.

What I was saying is some one made something that looks just the same as this but instead of doing what you stated it was a rat and but still worked as a generator