Steam Wallet Hacking

Hello guys !
Recently I have started trying to get free games on Steam...
I searched a little bit and i found some methods where you print fake recipe and after that go and complain to Steam that your code doesnt work... For me this looks pretty lame and i am not that kind of person. I prefer the real and 100% profit things... So i researched a little bit more and i find out that i can try brute force the wallet code... BUT brute forcing is slow and not 100% profit... Considering my experience i think that the machine that gives you the recipe for Steam Wallet code is connected to a server and your code is generated when you buy it... so the brute force success chanse drops really much...

I think the only way to get free wallet codes is accually penetrating the server's data base... but i dont have idea what is this server, where it is, what is its ip and so on... (ofc it should be well protected too)

so what do you think ? Please dont mention these SteamWallets sites where they give you code for serveys... it is scam i opened 3-4 page sources and i find out that when you click the button reedem they dont even check if you did a servey, they just show error message = SCAM...

If you want we can try getting some info for the Steam's wallet server... and maybe... who knows?!?

---------- Post added at 01:37 PM ---------- Previous post was at 01:32 PM ----------

P.S.
I guess Steam app is connecting to this server... and maybe we can use Wireshark or any kind of packet sniffer to get some info about the server...

---------- Post added at 01:42 PM ---------- Previous post was at 01:37 PM ----------

P.S. 2

this is C+P from Steam's website

Code:

<a tabindex="300" href="javascript:ValidateWalletCode();" class="btn_checkout_green" id="validate_btn">
							Продължаване						</a>

<div id="validate_btn_in_progress" class="btn_checkout_working" style="display:none">
							Обработване						</div>

"Продължаване" means "Continue" in english
"Обработване " means "Working..." in english

this makes me think we can just have some fun with the JavaScript funcs and just make the server we have a correct code

this is the stupidest thing i've ever seen.

P.S. 3 !!!
They use JS they uploaded the files somewhere in their server. I got the source i will change it ! Lets see !

---------- Post added at 01:53 PM ---------- Previous post was at 01:52 PM ----------

Originally Posted by Nikoteen

this is the stupidest thing i've ever seen.

why ? dont you want free Steam Games ?

Originally Posted by kmanev073

P.S. 3 !!!
They use JS they uploaded the files somewhere in their server. I got the source i will change it ! Lets see !

---------- Post added at 01:53 PM ---------- Previous post was at 01:52 PM ----------

why ? dont you want free Steam Games ?

This just keeps getting better.

Originally Posted by Nikoteen

This just keeps getting better.

thefuq ?!? first you say it is stupid now you say it is getting better ?

Originally Posted by kmanev073

thefuq ?!? first you say it is stupid now you say it is getting better ?

Yes, as in it is getting funnier and funnier to read.

Originally Posted by Nikoteen

Yes, as in it is getting funnier and funnier to read.

yes and i start feeling stupid and more stupid and i got the feeling i will work alone

Originally Posted by kmanev073

P.S. 3 !!!
They use JS they uploaded the files somewhere in their server. I got the source i will change it ! Lets see !

---------- Post added at 01:53 PM ---------- Previous post was at 01:52 PM ----------

why ? dont you want free Steam Games ?

hey ! igot the soltion! for cracking the free steam games wallet servers !! ok so first i cracked into the server then i hacked everything and now i have every steam game for ever, heres' how i do it you go into steam and then shove your router up your ass ! oke ! it workd tell me how it goes men !!

Originally Posted by kmanev073

yes and i start feeling stupid and more stupid and i got the feeling i will work alone

It is stupid. You will be working alone.

Do you seriously think Valve/Steam are that dumb to let an exploit like that to happen? Have you even bothered to find ValidateWalletCode inside the .js files? If you look at it, it performs an AJAX request that processes the request through Steam's server and returns the result of the request. If you modify the response, it will only be client-sided; Steam's servers will still know the wallet code is invalid and do nothing.

Also, if you try bruteforcing Steam wallet codes (there are 3247943160 possible combinations), I'm sure they've implemented a countermeasure against that (eg. limiting amount of requests in a specific period of time).

Originally Posted by master131

Do you seriously think Valve/Steam are that dumb to let an exploit like that to happen? Have you even bothered to find ValidateWalletCode inside the .js files? If you look at it, it performs an AJAX request that processes the request through Steam's server and returns the result of the request. If you modify the response, it will only be client-sided; Steam's servers will still know the wallet code is invalid and do nothing.

Also, if you try bruteforcing Steam wallet codes, I'm sure they've implemented a countermeasure against that (eg. limiting amount of requests in a specific period of time).

You ruined my fun.