[antisocial]

So i decided an hour ago to quickly take a look at fedz.rip - a biolink page from .cz forum

What i already found within just 3 minutes of looking at their claimed "End-2-End-Encrypted" messaging system, we simply discover that the private key of BOTH parts simply gets returned in the API response (Meaning they hold private keys in plaintext)

And after that we found SEVERAL critical vulnerabilities leading to us dumping their database, and come to find out, OBVIOUSLY they hold all users passwords in plaintext... what a surprise. I also dumped their admin chat including that.

This is just simply a Proof of Concept that the average user of .cz does not have any technical capabilities at all, they are completely clueless idiots. This is the least secured website i have EVER seen. This is worse then a beginner CTF.

https://pomf2.lain.la/f/ssb4o50f.jpg - PoC image

https://qu.ax/x/LZxrb.png - developers .cz post

https://qu.ax/x/I9SOK.png - developers .cz profile

Hidden Content

You must register or login to view this content.

[OpenBullet]

Beautiful work lol

[0BITS]

holly molly!!! the BF war v2.0
am loving it

[Asha_Official]

@antisocial Excellent work. I’ll archive this.

[paw]

Good work @antisocial <3

[cysc]

antisocial back again! good work gang

[jeanboelard]

So i decided an hour ago to quickly take a look at fedz.rip - a biolink page from .cz forum

What i already found within just 3 minutes of looking at their claimed "End-2-End-Encrypted" messaging system, we simply discover that the private key of BOTH parts simply gets returned in the API response (Meaning they hold private keys in plaintext)

And after that we found SEVERAL critical vulnerabilities leading to us dumping their database, and come to find out, OBVIOUSLY they hold all users passwords in plaintext... what a surprise. I also dumped their admin chat including that.

This is just simply a Proof of Concept that the average user of .cz does not have any technical capabilities at all, they are completely clueless idiots. This is the least secured website i have EVER seen. This is worse then a beginner CTF.

https://pomf2.lain.la/f/ssb4o50f.jpg - PoC image

https://qu.ax/x/LZxrb.png - developers .cz post

https://qu.ax/x/I9SOK.png - developers .cz profile

awesome

[XenoticSS]

So i decided an hour ago to quickly take a look at fedz.rip - a biolink page from .cz forum

What i already found within just 3 minutes of looking at their claimed "End-2-End-Encrypted" messaging system, we simply discover that the private key of BOTH parts simply gets returned in the API response (Meaning they hold private keys in plaintext)

And after that we found SEVERAL critical vulnerabilities leading to us dumping their database, and come to find out, OBVIOUSLY they hold all users passwords in plaintext... what a surprise. I also dumped their admin chat including that.

This is just simply a Proof of Concept that the average user of .cz does not have any technical capabilities at all, they are completely clueless idiots. This is the least secured website i have EVER seen. This is worse then a beginner CTF.

https://pomf2.lain.la/f/ssb4o50f.jpg - PoC image

https://qu.ax/x/LZxrb.png - developers .cz post

https://qu.ax/x/I9SOK.png - developers .cz profile

thanks lol they were pissing me off

[frenchfries]

lets check thank you sm

[natas666]

So i decided an hour ago to quickly take a look at fedz.rip - a biolink page from .cz forum

What i already found within just 3 minutes of looking at their claimed "End-2-End-Encrypted" messaging system, we simply discover that the private key of BOTH parts simply gets returned in the API response (Meaning they hold private keys in plaintext)

And after that we found SEVERAL critical vulnerabilities leading to us dumping their database, and come to find out, OBVIOUSLY they hold all users passwords in plaintext... what a surprise. I also dumped their admin chat including that.

This is just simply a Proof of Concept that the average user of .cz does not have any technical capabilities at all, they are completely clueless idiots. This is the least secured website i have EVER seen. This is worse then a beginner CTF.

https://pomf2.lain.la/f/ssb4o50f.jpg - PoC image

https://qu.ax/x/LZxrb.png - developers .cz post

https://qu.ax/x/I9SOK.png - developers .cz profile

thankx for sharing this