I coded a game.. and you guys hacked it

Thanks for watching! Make sure you subscribe for more cool videos.
Join Startup & Tech Discord:
/ discord
All my socials & links:
linktr.ee/anth...
My mind map (startup notes & essays):
map.sistilli.dev
My coding & video equiptment:
www.amazon.ca/...

[@AnthonySistilli]

For the few people in the comments who are going nuts for me being on the "just launch quickly" hype train - I coded this on stream where the whole point was to test if cursor could even make the game. Launching it and adding a leaderboard was a for-fun feature, and we knew it had glaring vulnerabilities but launched anyways for the lolz. It's a meme game captcha site I made in a day using AI and forgot about - not an enterprise SaaS :P Chill and enjoy the vid

[@adamslajer2203]

Be careful with serverless, make sure you have a low resource limit or someone can do a Denial of Wallet attack (basically DDoS, but your server auto scales to the load giving you huge bills)

[@1337ꜛ]

Yes a good way to stop this is add cooldowns to certain buttons

[@z27-br8wb]

@@1337ꜛ no lol

[@Amin04]

​@@1337ꜛ attackers don't use buttons.... Rate limits on endpoints won't work either as in most of times there's a lot of proxies & sessions involved

[@Taokyle]

DDoS your website gone, DDoW your money gone

[@thederpycoders7208]

@@1337ꜛ 💀 no lol, just no

[@hightidesed]

the moment i saw you generated the text on the frontend, i didnt even need to keep watching, thats not getting hacked as much as entering an open door is a break in...

[@raremc1620]

Exactly, literally not getting hacked, just getting a few cheaters in the game, entirely due to the creator not following common sense.

[@madghostek3026]

I love how the cheater was all puffed up "fix your cybersecurity", mate you discovered how to do a post request

[@LuxPlaysRBLX]

Hacking skills 10/10 Choice of victims -10/10

[@xX_NameHere_Xx]

fr

[@sc3dev]

hacking skills 1/10 (first one, its a really basic vulnerability) 3/10 (slightly less basic but still very basic) choice of victims 8/10 (its harmless, just leaderboard scores not anything important. the "hacker" even donated him $2)

[@cr_macca]

I love that this guy literally taught himself the complications with Catpchas and why they need to be secure lmfao (I assume he already knew and was just being a lazy agile dev, aka me).

[@jxnxsdev]

I once managed to make a game website which a leaderbaord display a rickroll in full screen. All i did was write some html which puts itself on top of the page and includes the video element. I then put that as the username and as the input wasnt sanitized the browser rendered it as normal html.

[@yodaluca23]

SQL Injection baby!

[@N____er]

​@@yodaluca23Not SQL injection, this is just some HTML injection or maybe you could call it XSS if you want

[@jxnxsdev]

@@yodaluca23 I mean technically it's HTML injection as it's not trying to break into the Database

[@someoneunknown6894]

I wonder if you could also use tags, because if yes, you found an xss (a vulnerability where the hacker can run JavaScript) That for example can allow the hanger to steal cookies, passwords or whatever on that site

[@haithem8906]

you can also solve this by not using a database. and instead generate the captcha in a JWT token that includes the username, createdAt, and the game session i.e the generated captcha. with a encrypted text storing the answer (yes inside the JWT, double encryption baby. so that they can't just get the answer from the jwt token and spam the server). but now we need a way to confirm that the user isn't just spamming the same request ... hmmm maybe we need a database afterall to store the ID of that jwt token.

[@z1xus]

use timestamp and signature headers, thats it

[@inuyasha331]

Umm... what captcha are you showing the user? "so that they can't just get the answer from the jwt token and spam the server" The answer is the question. If you can't get the answer on the client then you can't get the question. The webpage isn't "enter the random encrypted captcha you can't read" it's "fill in the captcha" which you need to be able to show. This is entirely why you'd use an image generated on the server. The image contains the question and the answer but not in plain text that can be read by the client.

[@haithem8906]

@@inuyasha331 I'm assuming the process of making the captcha is irreversible. Because if it is. The client would easily automate it by doing the same thing. Edit: irreversible programmatically

[@inuyasha331]

@@haithem8906 makes more sense but really strange since one of the problems highlighted in this video is that it's NOT irreversible as it's implemented which is why I asked.

[@haithem8906]

@@inuyasha331 its true but if your contractor suggest that you make them custom or difficult. you will be in a weird spot. and you would have to re-write everything.... i'm a freelancer and i've almost always regretted not opening ahead.

[@chinochao]

"Come see me build vulnerable sites in my live stream" 😂 Nothing personal just for fun.

[@Organmannn]

4:16 what about function generating string, generating image from that, and preserving only hash of the string, later checking if hashed response matches hashed string? Like this is dumb base password encryption xd

[@stumblairo3721]

Atleast you have 2 coffes now

[@Free_kitty0]

Moral of the story never trust the client, you trust the client and you end up with bizarre stuff

[@sidakvats693]

When is the next episode of roasing dev portfolio is coming??

[@lightdesign1285]

portfolio roasting when

[@hamzacasdasdasd]

why do i over complicate thinks i thought people used same captcha solve and get infinite points

[@aryangurung30]

Even if you generate the image on the backend and send the image to front end. Its still very easy to write an automation to solve the captcha

[@kxdsh]

I'm not a developer so sorry if this is a stupid suggestion but how about two algorithms. One generates the image without storing the plaintext (making the characters out of bezier curves or some other convoluted method to display the characters that wouldn't give the answer in the frontend) and another that calculates the plaintext after an answer is submitted. In theory you shouldn't be able to easily derive the answer on the fronted with that right. I also get this was a for fun project and all that would be too much hassle but the concept has intrigued me

[@1owrller]

retarded

[@spieles21]

you could make that you only send a encrypted/hashed text between the client and the server, so the client needs to be a encrypt the text, first the client needs to encrypt the solution letter for letter and sends it to the drawing subsystem, so no where in the code is the full solution possible to read, than you could also use an JS obviscater to make it harder for hackers to debug whats going on inside the JS. Not the best but hey.

[@stephenjason7575]

Laravel Generate Captcha from the Backend Normally

[@nezu_cc]

Hacking used to be easy (by modern standards) back when people were clueless, then it got harder as devs became more aware of all of the potential ways people can and will abuse their services. And now we're back to square one with these new devs that prioritize development speed, ease of use and all the other buzzwords and really love doing server side jobs on the client because it saves them money or whatever. I hate PHP just like the next person, but re-code this in PHP (or any other server side language) without using client side js and this fuck up is borderline impossible to do unless you're an absolute moron and somehow send the solution with the image. Sure, this is a simple game, but I've seen (and sometimes abused) similar scale fuckups on apps where you can get real life rewards. I'm not complaining, more free stuff and fun for me, but this was a solved problem already, now we're going backwards and re-inventing all the possible ways to fuck up but with extra buzzwords.

[@peredo_]

where do i play

[@epicstar86]

This is so underrated, how do you only have 84k subs

[@AnthonySistilli]

same :D

[@echtertimo]

Whats the url of the game?

[@pelaajahacks8358]

just make a tiny svg?

[@mrowlsss]

That was what I was thinking. Make the text into individual paths though.

[@Kurayami-zx1cv]

What if you use salting and hashing to hide what the text equal to.

[@refraction15]

That wouldn’t work because with the way his game is programmed, the frontend has to know at some point what the text is, defeating the point of trying to hide it.

[@neofox2526]

@@refraction15 but you hash the user's answer and compare it to the hashed answer on the frontend

[@Hack--rz1io]

​@@neofox2526The user has the raw data at some point to make the image even if it's hashed afterwards it won't fix the problem

[@inuyasha331]

@@neofox2526 If the server sends the client a hash then you can't display the captcha because all you have is a hash. Hashing what the player sends solves nothing because you still need to send the raw text to the client. The server has to send only an image of the captcha for this to be secure.

[@barry5]

Your real mistake was using vercel.

[@muayyadalsadi]

1:52 no need, just make the backend have a temper-detection signature. Hmac would do it. And one way hash on both sides to make sure they are equal. No need for database.

[@user-zz6fk8bc8u]

That wouldn't really work. He is right, as long as the text is available in the frontend (for example for image generation) you have already lost because you can manipulate the frontend to auto-submit.

[@muayyadalsadi]

There is no need to maintain a database of sessions storing what session has which correct word and what was the previous score. Just generate a random word, do one way hash with server secret. Send the base64 image, previous score, and signature to the client. When the client send back an answer. Hash the answer using same secret of the two hashes matched then accept the answer to be correct.

[@WantedForTwerking]

how else am i suppose to use my 12 month free tier AWS RDS multi AZ DR SMD service??

[@richmail]

Not to say you're solution isn't valid or easier to implement, but that can also be bypassed.

[@user-zz6fk8bc8u]

@@muayyadalsadi now I get what you mean. You are right it can be made stateless but the image generation has to happen on the server.

[@frozenheart7133]

😂 when the karen from the office says "why can't you just..." 22 hours and 6 ibprophen later 😂

[@FrederichPedersen]

I hate serverless devs, the only thing you do is: "ooh, new project, niceeee, deploooy", error because I don't do anything on the server side? What about just scrapping the project Buy a damn vps, and create things the right way

[@mahdiuser100p8]

my man coded the most usless thing in the whole universe and called it " COOL THINGS "

[@drdca8263]

No contradiction there

[@1CrypticData1]

The reason this happened was because you showed the code in the stream so people was able to abuse these vulnerabilitys and hack it am a professional hacker and your website is still very vulnerable get good lil bro

[@aviewer4442]

whats a seed

[@olafbakke-uh3xt]

Make a leaderborad

[@josezarazaga3773]

Me as a new viewer: what tha hell is this?

[@mrgamer-lu1im]

But you can use image recognition with opencv and still hack it. but even then based on your explanation it is still pretty easy to hack

[@raremc1620]

Not hacking, cheating

[@mrgamer-lu1im]

@@raremc1620 Lol hacking is all about creativity lol

[@ItzRxr]

Cheat engine be like devs : i made a shitty game i hope nobody abuses the fact theres no anticheat Cheat enginge users OMG 99999999999999999999999999999999999999999999999999999999 score on a unity game omfg

[@janfkarel92]

Could you encrypt it?

[@inuyasha331]

Not going to help in any way. Here's an encrypted string: ak494933jjgv8gj8g. I want to show the user the captcha that was encrypted in this string. What do I have to do with it? That's right, decrypt it. On the client who then has access to the function to decrypt it. There's nothing stopping the user from calling the decrypt function to get the captcha. All you've done is add extra work to solve nothing.

[@jimmlmao]

store the game state server side

[@u-k]

Welcome to web development. This is pretty basic stuff.

[@theshy6717]

skill issue

[@vaibhavkhating1708]

Skill issue

[@lea0o0oo]

Try jsdom

[@kazukisenpai2405]

bro, you need sleep o_o

[@wuemeliiiiiiiiiiiiiiiiiiiiiii]

L coder frfr

[@shizwhiz7961]

Skill issue ngl. /s

[@Dominion78]

crazy people still do /s

[@echtertimo]

What does it mean?

[@devnom9143]

​​@@echtertimo"/s" is a way to indicate when something is intended as sarcasm & is internet lingo that hasn't really managed to become mainstream, though it's meaning does turn up in Google search results thanks to multiple people asking what it means on Reddit

[@Dominion78]

@@echtertimo s for sarcasm

[@kaninchengaming-inactive-6529]

Bro got Unbreaking II profile picture

[@jujhar.]

K

[@RandomytchannelGD]

Hi

[@flexlv1464]

Skill issue tbh

[@kkMihai1337]

L coder

[@NxVernxual]

L coder, skill issue

[@Mark--__--]

If you're so good do it yourself

[@ExtremeContent-hq]

Get back ipad to your mom lil buddy🧃🤡 You know everyone suck at coding no matter how good your code is. you will always find some mistake in your code🙂 I myself is a programer I code in C and I always find mistake in my code fix the mistake improve the code. that's how you learn knowledge is infinite not limited 😂

[@xhthng3441]

Love how the people here don’t know that it’s prolly satire

[@ExtremeContent-hq]

@@xhthng3441 Whatchu mean?

[@itsalexdev]

If your soo smart do it yourself 🤡

[@7heMech]

This is just bad design, I don't even know anyone who would make such an app even as a sample.

[@pelaajahacks8358]

yeah couldve used svgs that are like 20kb

[@Carlos-cp6td]

CORS: 👀

[@budgetarms]

So true, many companies have small little mini games that are easily hackable if you want to make a quick buck (pin me)

[@spoonikle]

skill issue.