www.phpnuke-downloads.com hotlinks from ravenwebhosting.com

Sells PC To Pay For Divorce Joined: Posts: 5661

http://www.ravenwebhosting.com/xxxxx/xxxxxx/block-ForumsCollapsing.zip#get

ok raven...thought i make this a special topic...
Im sure your not aware of this:
www.phpnuke-downloads.com is directly hotlinking to the above file.

view his page here:
http://www.phpnuke-downloads.com/download13-160-dateA-10.html#categorystart

EDIT:
also these files are linked directly.
Auto Registration Activation Mod v1.0
http://www.ravenwebhosting.com/xxxx/xxxx/AutoActivate-v7.zip#get

And
http://www.ravenwebhosting.com/xxxx/xxxx/autoActivateMod.zip#get

Also i recommend everybody to view my topic here:
http://www.ravenphpscripts.com/postxf8505-0-25.html

the list of websites he hotlinks the files from is getting huge...

Theme Guru Joined: Nov 01, 2003 Posts: 1006

i find that behavior to be rather unsettling Neutral

Posted: Fri Feb 17, 2006 6:23 am

oh but my dear jaded thats not all...
i had some sleep so i continued the search....
ok galen...the next few...

PHP-Nuke Package[RavenPHPScripts] v2.0
http://www.ravenwebhosting.com/xxxx/xxxx/rwsRavenNuke76_v1.05.00_FULL.zip#get

and

http://www.ravenwebhosting.com/xxxx/xxxx/rwsRavenNuke76_v2.01.00_FULL.zip#get

Posted: Fri Feb 17, 2006 6:25 am

as a follow up i went there and i found great amusement in the following. when you attempt to download from there.

Quote:

IMPORTANT: In an effort to prevent bandwidth theft, We have implemented measures to ensure that the download requests are only processed from our site. This mechanism is not compatible with all anti-virus software, download accelerators, and proxies. If you make it through to the download request screen and then get a Forbidden message, the chances are it is a result of one of the three things just mentioned. In that case, you will have to temporarily disable or tweak the settings for those applications to allow the download.

Thank You For Your Co-operation.

the idea that they are concerned about bandwidth theft simply cracked me up killing me

Posted: Fri Feb 17, 2006 6:59 am

whitch file did you tried cause i could still download the collapsable .......

Posted: Fri Feb 17, 2006 7:01 am

LOL, he has half of the nuke sites out there, nukeresources included, hotlinked. With the number of downloads everyone is having their transfer stolen. I have to say that if you cannot afford to host the site you want then don't run one. If the only way that you can run a website is to leech off the back of every other site out there then give up the dream. I suggest that you buy more space and bandwidth, get rid of the hotlinks, and try to run your site legitimatly. Smile

Posted: Fri Feb 17, 2006 8:44 am

jaded wrote:

as a follow up i went there and i found great amusement in the following. when you attempt to download from there.

Quote:

IMPORTANT: In an effort to prevent bandwidth theft, We have implemented measures to ensure that the download requests are only processed from our site. This mechanism is not compatible with all anti-virus software, download accelerators, and proxies. If you make it through to the download request screen and then get a Forbidden message, the chances are it is a result of one of the three things just mentioned. In that case, you will have to temporarily disable or tweak the settings for those applications to allow the download.

Why do I always laugh when i see those messages on a php-nuke download module?
This is 100% FUD information (also known as hoax), because the information is false.

Example: http://phpnuke-downloads.com/downloads/phpnuke/72-73patched.tar.gz
Now how did i get that, although they say they have an meganism?
(note the page says 404 but just press [enter] in the address bar, that will reset HTTP_REFERER to empty so you bypass his protection)

No wonder people hotlink nuke sites, it's always possible Laughing

Now you go try that on Trevor and mine superior Downloads Pro module for Dragonfly, hehehe.

Posted: Fri Feb 17, 2006 8:52 am

Hmm if people are interested i could write a bot that lists all his downloads so you can mirror/hotlink them.

Posted: Fri Feb 17, 2006 8:54 am

oh yeah do please......
ill drop it on a few friendly sites where it can be downloaded a few 100.000 times....

Posted: Fri Feb 17, 2006 9:07 am

fetch.php file:

Code:




<?php


if (isset($_POST['id'])) {


    echo base64_decode($_POST['id']);


)


?>


<form action="fetch.php" method="POST">


fetchid: <input name="id" value="aHR0cDovL3d3dy5waHBudWtlLWRvd25sb2Fkcy5jb20vZG93bmxvYWRzL2Jsb2Nrcy9ibG9jay1kYmNsb2NrLnppcA==">


<input type="submit" name="Download It" value="Download It">


</form>

The value for fetchid can be found on a phpnuke-downloads.com download page at:

<input type="hidden" name="fetchid" value="foobar">
where 'foobar' is a long encoded string

The id in the above code decodes into http://www.phpnuke-downloads.com/downloads/blocks/block-dbclock.zip

copy the url into your browser address bar and hit enter.

hitwalker, i could write a more sophisticated system that allows you to completely replace your downloads module with a hotlink module.
But that's not realy fun for me, anyway with the above example you should be on your way.

NOTE: This is the only PoC i have ever provided on this website and will hopefully be my last. I've provided this PoC not because someone is a asshole but more based on many assholes that disbelieve my warnings and words that i should stop mentioning that i could hack them. This simple PoC should be enough to let you all know i know enough about php-nuke for not using it.

Posted: Fri Feb 17, 2006 9:10 am

so is this type download per download or is it somehow automated..?
or how to go for that?

Posted: Fri Feb 17, 2006 9:15 am

1. go to a download on his website that you want.
2. view source
3. find in source: name="fetchid"
4. copy value into fetch.php script

I could make it fully automatic using preg_match() but i don't. It's just bad to ask an "eye for an eye"

Posted: Fri Feb 17, 2006 9:19 am

yes i understand but people have to do to much work with way......lol

Posted: Fri Feb 17, 2006 10:00 am

Guys/Gals, sorry if I have inconenienced anyone, but I moved this here due to DJ's POC. Awesome POC by the way, but I just can't stand the thought of some kiddie out there getting it.

Now come to think of it, I didn't actually see the exact forum it was in before, so I may have moved it to a forum with the same security perms.

Want Raven to see this before putting it out there for all to see.

-sting

Site Admin/Owner Joined: Aug 27, 2002 Posts: 17088

Thanks Sting for your sensitivity in this matter. After having talked to DJ about it and reading it over, I think it will serve more purpose in the open than not.