[Misha-]

I noticed that this website is using mod_rewrite in a nice fashion, so I decided to mess with it.
Here's how to read threads which you shouldn't be able to read.

First, we need the id of a thread which we can't access.
https://sinister.li/Thread-Bidroop-project

Spoiler:

How you get the ID is up to you.

Now, since we know the forum is running MyBB, we know that the path for showing a thread is http://thisisanexampleorisit.com/showthread.php?tid=1
So instead of using Sinisterly's mod_rewritten bullshit (https://sinister.li/Thread-Bidroop-project), we're going to do it the normal way.
https://sinister.li/showthread.php?tid=10007
Still can't read it though.

Now we use some old MyBB trickery, replacing showthread.php with printthread.php
https://sinister.li/printthread.php?tid=10007
And now we can read it.

Spoiler:

I actually wrote an addon for firefox to automatically replace showthread with printthread lol.

Anyway, that's all for this shitty, but fun tutorial.
Something you may want to try is just kinda bruteforcing thread ids and looking for fun stuff.
Example:

Code:

https://www.sinister.ly/showthread.php?tid=10001 https://www.sinister.ly/showthread.php?tid=10002 https://www.sinister.ly/showthread.php?tid=10003 https://www.sinister.ly/showthread.php?tid=10004

etc.

[lux]

Ain't even mad. Good find.

It's nice to see users using their initiative.

[Misha-]

Ain't even mad. Good find.

It's nice to see users using their initiative.

Ah, good to hear.
There was always the thought in the back of my mind that I could get banned for this thread.

[lux]

Ah, good to hear.
There was always the thought in the back of my mind that I could get banned for this thread.

Whilst it does kind of bypass the point, it was a good find. This would be a thread which belonged in a restricted sub-forum, so it cannot impact the userbase in which it relates to, unfortunately with you being a new member that's unlikely to happen.

But still, have a plus rep and a fedora tip.

Spoiler:

[Misha-]

Whilst it does kind of bypass the point, it was a good find. This would be a thread which belonged in a restricted sub-forum, so it cannot impact the userbase in which it relates to, unfortunately with you being a new member that's unlikely to happen.

But still, have a plus rep and a fedora tip.

Spoiler:

I doubt i'm gonna sell any products, so I don't think i'll really need the rep, but thanks.
It's the thought that counts.

[Misha-]

Another way of bypassing it :

Go here.
https://sinister.li/misc.php?action=syndication

Choose which forums you want to look in (you can select several)

Spoiler:

Then put as much as you want on limit, i'll go with 50.
Now click generate link, which gives me this:
https://sinister.li/syndication.php?...7&limit=50

Now you can visit that and read the content of the threads.
Or if you want to do it faster, just edit the forum ids in the url.
(These - fid=296,297)

[Lain]

mod_rewrite? nginx? What is this madness?

This is a nice find though, thanks for sharing.

[Eclipse]

Ah, good to hear.
There was always the thought in the back of my mind that I could get banned for this thread.

Naa, we welcome users taking the initiative to find vulnerabilities. It gives @Oni the chance to fix them. Ideally, this should have been posted in a restricted sub-forum, but it's not that big of a deal.

[Oni]

Bumping this, as I need to fix this still.

Also: