Account Dupe Fix

[Matt]

Originally posted by GodSentDeath

Originaly Posted By: Jobs

This was made by Danny

On server side
in modServerTCP
in the

Code:

' ::::::::::::::::::::
' :: Login packet ::
' ::::::::::::::::::::

add
[code]
' Prevent Dupeing
For i = 1 To Len(Name)
n = Asc(Mid(Name, i, 1))

If (n >= 65 And n = 97 And n = 48 And n

[Acruno]

Sorry for the Necro, but what does this actually do?

[GIAKEN]

It only allows certain characters for the person to use in their name. This needs to be done wherever there's an input for character data (guild, password, whatever) because you can easily get Access=4 or whatever you want with something like Name & vbNewLine & Access=4 and so on.

[Matt]

With default Mirage, and in any game that has not added this fix, you can login with your username and password, for example:

ID: MyName
Pass: 1234

Then you can open the client again and login again, on the same account, by using this:

ID: /MyName
Pass: 1234

Again, and again. Dropping your items on one client, picking them up on another, then logging out with the empty account first. Then logging out on the account with all the items, saving all your duped, illgotten items, money, etc.

^_^

[GIAKEN]

Well I just figured out the admin thing on Labmonkey's game by having the source and sending the guild name packet

[Acruno]

Thanks, I understand now

[Matt]

If you use MySQL, I don't think any of these injection type attacks would work. But is the account duping still present or does it depend on using ini files?

I have no idea. Give it a try on your game.

[Labmonkey]

you can sql inject

lol, it was reposted by like 4 people.

[Joost]

[code]' Prevent Dupeing
For i = 1 To Len(Name)
n = Asc(Mid(Name, i, 1))

IfNot (n >= 65 And n = 97 And n = 48 And n

[Matt]

[quote="Joost"][code]' Prevent Dupeing
For i = 1 To Len(Name)
n = Asc(Mid(Name, i, 1))

IfNot (n >= 65 And n = 97 And n = 48 And n

[Acruno]

LOL


Just out of interest, why DOES putting in certain characters/strings have an effect?

[Reece]

As for the /name thing I think it checks if the account is online before it cleans the string of "bad" characters.

As for the admin = 5 thing,

If you write "Name = " and let the person specifiy what comes after that... they can make it say, "Dave & VBNewLine & Access = 5"

Then the file will look like this:
Name = Dave
Access = 5

See the problem?

SQL injections are similar.

Can't you just check to see if "VbNewLine" is in the textbox?