Gold Exploit Finding

Posts 16–30 of 123 · Page 2 of 9

12369

Originally Posted by bluuman

is that already patched? also, what other game uses xsolla.

Bunch of small games, I know agar.(io) uses it, maybe some other :P

Originally Posted by Riigged

also the method that deca thinks catchme used/is selling is stolen credit cards, which i guess could be its own method if anyone bothers to browse deep web for it.
how we found out, a tester sent me a picture that was mentioned on a disc0rd chat that only testers+admins+devs are in im assuming, but he blocked out part of it, and this god 059 managed to smoothly find out what was behind the big black blob of paint

I threw out my guess at stolen cards a long time ago. it makes the most sense, as an exploit that involves actual money will get deca's attention pretty damn quick. It also explains why people get banned for "chargeback". If your card info got leaked, next time you viewed your credit card statement/online activity you would probably do a chargeback. That would explain why it was extremely hard to predict when an account would be banned. Some people got banned within a few days, others never got banned. My guess is he started using crappier sources for stolen cards or something and that is why we started seeing more and more people getting banned.

I also, without hard proof or verification from catchme himself, strongly dont buy the fact that editing the POST values on the payment site is how it was done. The post values are sent to the webserver, which then verifies them. If you notice, in the post values you showed in the top post, there was no "$5" post value AND a "500" post value (so $5 for 500 gold). It only sends out the amount you are buying, the server would then verify the amount you requested though the post values and charge you accordingly. So if you changed 500 to 16000, the next page would say you owed $20 not $5. A payment website that doesnt verify post values is unbelievably unlikely. I do web programming for a living and one of the first things any competent web developer would do is sanitizes then validate the values. So for a 3rd party payment system that sells its service to companies to not do this...it would be a lawsuit on their hands if someone found a way to exploit their system. Now, back when kabam ran their own payment gateway (i didnt play back then so i dont know enough about it), which means they probably programmed it, i could understand an exploit like that. But not with the new payment system that has been in place for awhile now.

Originally Posted by toddddd

the method in the main post isn't 100% correct (obviously) but very very close (pretty much the method is the opposite of what i said in the op)
talking to a lot of people (who bought the method, know people with the method who are doing the same thing i am doing, etc) and getting much more deeper into how the payment system works

catchmes method, the amount he receives isn't what he edits, the amount he pays is what he edits, he gets the 16k gold package for less than $5 (i guess you can only do this 5 times because according to someone who bought the method, they said 80k is max you can get), thats all im saying for now while i try to fully work this
(editing the price you pay is indeed possible, its what this program as shown in the pic is most known for, ive already used it on plenty of basic rwt sites that accept paypal as a test, but for realm, its quite harder to find the amount being paid in the data)
its just a matter of finding out how catchmes program does this

deca cant sue xsolla from this exploit because they are still making money, just because they are getting more gold than they are paying for, deca still isnt losing any money

Has anyone successfully used this at this point?

Originally Posted by Riigged

deca cant sue xsolla from this exploit because they are still making money, just because they are getting more gold than they are paying for, deca still isnt losing any money

Thats...thats not how the law works at all...lol

Just because you made SOME money doesnt mean everything is ok. They are losing lots of revenue due to an exploit in a 3rd party's system. That is definitely grounds for a lawsuit. Which is why i find this extremely hard to believe. But ill sit back and wait until someone proves otherwise i guess.

just to edit this to explain more: just because the gold doesnt cost deca anything to "make" doesnt mean that it isnt worth something. CLEARLY its worth a monetary value if its being exploited and sold. Its a virtual currency. It has a real world value. Thus, they are losing money when it is stolen (exploited). And if it was being stolen in the method you are trying to explain, that would mean it is not deca's fault they are being stolen from, its the 3rd party's fault (xsolla) they are being stolen from.

Originally Posted by toddddd

deca is not losing money from this exploit, they just arent gaining as much as they should.
is what i was trying to say.

Originally Posted by Riigged

deca is not losing money from this exploit, they just arent gaining as much as they should.
is what i was trying to say.

How? How are they not losing money? They are getting $5 but giving out 16000+ ($20+) gold instead of 500 gold. Please tell me what math you did to make that equation make sense.

Originally Posted by toddddd

How? How are they not losing money? They are getting $5 but giving out 16000+ ($20+) gold instead of 500 gold. Please tell me what math you did to make that equation make sense.

They didn't lose money, but they lost potential profit. So they did lose money. Anyways, is it possible that the payment exploit is made possible by some faulty configuration by deca?

Originally Posted by toddddd

How? How are they not losing money? They are getting $5 but giving out 16000+ ($20+) gold instead of 500 gold. Please tell me what math you did to make that equation make sense.

gold != money
its just a virtual currency in-game only, it has no real life value
they could give everyone in the game 9999999 gold and they wont lose money, yes, they will probably stop gaining money due to people wouldnt want to buy gold since they would already have a large amount
there is difference between losing money and not gaining money

- - - Updated - - -

Originally Posted by bluuman

They didn't lose money, but they lost potential profit. So they did lose money. Anyways, is it possible that the payment exploit is made possible by some faulty configuration by deca?

either by deca or xsolla, one or the other.

Originally Posted by bluuman

They didn't lose money, but they lost potential profit. So they did lose money. Anyways, is it possible that the payment exploit is made possible by some faulty configuration by deca?

Originally Posted by Riigged

gold != money
they could give everyone in the game 9999999 gold and they wont lose money, yes, they will probably stop gaining money due to people wouldnt want to buy gold since they would already have a large amount
there is difference between losing money and not gaining money

...im just going to stop replying now. You clearly dont understand how a business or a product of that business works. If something has a REAL WORLD VALUE then it is just as good as money (to the right people of course). Hence the reason catchme was selling gold account. He wouldnt be selling gold accounts if they werent worth anything. The gold on those account = money. gold = money. Deca LOST PROFIT everytime gold was given to a player without it being paid for legitimately. LOSING PROFIT is losing money. xsolla caused deca to LOSE MONEY. Just holy fuck how do you not understand this? edit: this is of course under the assumption that the gold accounts were obtained using an exploit in the payment system, which i still dont believe as ive stated. But if they were, then yes xsolla is at fault and deca LOST MONEY because of xsolla.

Originally Posted by toddddd

Yes they lost potential profit, that would be considered losing money for a business. And if you can trace that loss of money (potential profit) to a source outside of your company, and that source guaranteed security, that would be a large enough reason for a lawsuit. Still not sure how Riigged isnt seeing that.

If the cause of the problem ends up being deca's fault, then of course they cant sue over that. It was their own fault. But based on the exploit example from the first post, that would be an exploit in the payment gateway (which would be xsolla). Which is just one of the many reason i say i dont believe the method has anything to do with that. But i could be wrong, just waiting for some solid evidence to prove otherwise really.

...im just going to stop replying now. You clearly dont understand how a business or a product of that business works. If something has a REAL WORLD VALUE then it is just as good as money (to the right people of course). Hence the reason catchme was selling gold account. He wouldnt be selling gold accounts if they werent worth anything. The gold on those account = money. gold = money. Deca LOST PROFIT everytime gold was given to a player without it being paid for legitimately. Just holy fuck how do you not understand this?

answer me this
if deca is losing money, then why havent they sued xsolla like you said they would?

answer: they arent losing money, thats why.

answer me this
if deca is losing money, then why havent they bought the method from catchme, or one of the dozens of people who bought it/got it from friends/etc so they could find how the method is 100% being executed, and patch it?

answer: they arent losing money, thats why
-------------------------------------------
they dont lose money from this exploit. if i were to do this exploit, i would be getting 16k gold for a few bucks (catchme himself said each time he did it he only had to put in like $3-4), i get gold, now, what does gold buy? it buys stuff in-game, it does not buy you food irl, it does not pay your rent, it does not pay your car insurance, no, it buys you some keys and some chances at the mystery box and some items in-game. gold is not worth any money in the "real world". deca is not losing any money, they are losing money they COULD have gotten from someone who is legitimately buying 16k gold for $100, but nothing is being deducted from their balances/wallets/accounts/whatever you wanna call em.

go ahead stop answering me, i will keep proving my said point and you will keep proving your said point, it will just be a cycle.

Originally Posted by Riigged

answer me this
if deca is losing money, then why havent they sued xsolla like you said they would?

answer: they arent losing money, thats why.

answer me this
if deca is losing money, then why havent they bought the method from catchme, or one of the dozens of people who bought it/got it from friends/etc so they could find how the method is 100% being executed, and patch it?

answer: they arent losing money, thats why
-------------------------------------------
they dont lose money from this exploit. if i were to do this exploit, i would be getting 16k gold for a few bucks (catchme himself said each time he did it he only had to put in like $3-4), i get gold, now, what does gold buy? it buys stuff in-game, it does not buy you food irl, it does not pay your rent, it does not pay your car insurance, no, it buys you some keys and some chances at the mystery box and some items in-game. deca is not losing any money, they are losing money they COULD have gotten from someone who is legitimately buying 16k gold for $100, but nothing is being deducted from their balances/wallets/accounts/whatever you wanna call em.

go ahead stop answering me, i will keep proving my said point and you will keep proving your said point, it will just be a cycle.

They arent suing xsolla BECAUSE THERE IS NO EXPLOIT IN THE PAYMENT GATEWAY (xsolla's payment gateway) AS IVE STATED. Holy hell. (edit: until someone somehow proves it was xsolla/payment systems fault)

I have said, countless times now, IF there was an exploit in the payment system THEN deca COULD sue xsolla for lost revenue (profits/money). God damn.

Originally Posted by bluuman

They didn't lose money, but they lost potential profit. So they did lose money. Anyways, is it possible that the payment exploit is made possible by some faulty configuration by deca?

Doubt it because these accounts existed under kabam didn't they? It has to be steam or another 3rd party platform.

Originally Posted by 059

Doubt it because these accounts existed under kabam didn't they? It has to be steam or another 3rd party platform.

If you look on the forums here there is a really old post where somehow showed the old exploit used for getting gold wayyy back in the day. The used kongregates payment system and just entered bogus card info. Think there was something else about it too, but that was the general idea. Which is basically the same thing as using stolen cards, except i think that exploit relied on the payment system not verifying the card right away or something. Ill see if i can find that post.

Originally Posted by toddddd

lol they really aren't losing any money, if they were they would put a stop to it. if they are going to shut the game down for a day to work on patching a dupe, i am sure they would do the same to patch something that it causing them to lose money.

now unless you are decas accountant, i dont want to hear no more "yes they are losing money!!!!"