mIRC Home    About    Download    Register    News    Help

Print Thread
Joined: May 2006
Posts: 22
S
schism Offline OP
Ameglian cow
OP Offline
Ameglian cow
S
Joined: May 2006
Posts: 22
I have a script that accesses a website and retrieves information, problem is a login is required to do so, and I currently login with a cookie which has the password encrypted in it (at least I think it's encrypted)

I have registered an account just for this script to use, and it's working fine. But when I pass this script out, it will be possible to use the line of code from the script to login to the account via a browser and possibly make the script no longer work. I plan on only giving the script to a few friends, but I'd still like to make it at least hard to login to the account outside of the script, if even only by making the login cookie look different within the script. Any suggestions?

If it becomes a problem later on I suppose I'll just add a login command to the script so everyone can use their own account.

Last edited by schism; 26/05/06 04:18 AM.
Joined: Dec 2002
Posts: 417
O
Fjord artisan
Offline
Fjord artisan
O
Joined: Dec 2002
Posts: 417
even if you encrypt the script with your password. any scripter can decode your code and gain access to that web site

The only way to bypass it would to create a code where the end user would have to go through you to gain access to the web site. thru a trigger




Intelligence: It's better to ask a stupid question, then to prove it by not asking....
Joined: May 2006
Posts: 22
S
schism Offline OP
Ameglian cow
OP Offline
Ameglian cow
S
Joined: May 2006
Posts: 22
Quote:
even if you encrypt the script with your password. any scripter can decode your code and gain access to that web site

The only way to bypass it would to create a code where the end user would have to go through you to gain access to the web site. thru a trigger


I realize that, but still, what would be a good way to pseudo-hide the line within the script?

Like I said, the script will only be given to a few friends who actually have a good use for it. If it becomes a problem I'll add a script where they can use their own account.

Joined: Sep 2003
Posts: 4,230
D
Hoopy frood
Offline
Hoopy frood
D
Joined: Sep 2003
Posts: 4,230
i suggest you use a binvar and load it up with the needed text of the cookie using its asc values, but lead it off with a zero asc value (reason at bottom), also create a var called %1 and set its value to 1 and then later in the code inc it once so its value is 2 (reason at bottom), when u need to send it to the website use $bvar(&binvar,%1,999)

example, im going to use the text "DaveC" as what i want to *encrypt*

...
var %1 = 1
... other code ...
bset &binvar %1 0 68 97 118 101 67
... other code ...
inc %1
... other code ...
sockwrite ... $bvar(&binvar,%1,999).text
...

That should be enough to put the average browser of your script off from locating it, its not really encrypted, as any encryption can be just hacked at the point you send the cookie data with a simple //echo -s being added to the front of the sockwrite, or a duplicated line of it, if the sockwrite is needed etc.

* just to make it clear %1 holds the value 1 when its needed as 1 when you create the binvar, but later (hidden in other code if possable) you increment it to 2
* the binvar has a asc value of 0 as the first character, so if someone added a //echo -st $bvar(&binvar,1,999).text it wont show anything becuase 0 stops the text displaying
* the %1 is actually 2 at that time so displays from the 2nd character

This is of course just rudamentry jiggling to offset the average viewer, anyone with any scripting skill is going to see past it, and its still gonna get snapped by the "//echo -st" on the fornt of the socketwrite


Link Copied to Clipboard