WPE Scan when received mail (tested on WoWbeez)

[joowz]

This is not yet a fully working filter but hopefully some of you can find a way to use it.
This is what I got while scanning with WPE on GM island with no one around and getting a mail with 12 wowbeez tokens and 500 gold.
maybe you can try to resend the code to receive unlimited mails.

1  192.168.0.101:1231  74.86.171.139:9871  14  Send  
0000  55 A3 9F A0 55 D5 08 00 00 00 8C 00 00 00          U...U.........

2  74.86.171.139:9871  192.168.0.101:1231  2  Recv  
0000  54 06                                              T.

3  74.86.171.139:9871  192.168.0.101:1231  6  Recv  
0000  C5 05 08 00 00 00                                  ......

4  192.168.0.101:1231  74.86.171.139:9871  14  Send  
0000  F7 82 0C 69 54 93 09 00 00 00 96 00 00 00          ...iT.........

5  74.86.171.139:9871  192.168.0.101:1231  2  Recv  
0000  87 CB                                              ..

6  74.86.171.139:9871  192.168.0.101:1231  6  Recv  
0000  C8 C9 09 00 00 00                                  ......

7  192.168.0.101:1231  74.86.171.139:9871  14  Send  
0000  94 07 74 54 6F 23 0A 00 00 00 93 00 00 00          ..tTo#........

8  74.86.171.139:9871  192.168.0.101:1231  2  Recv  
0000  7E 04                                              ~.

9  74.86.171.139:9871  192.168.0.101:1231  6  Recv  
0000  03 89 0A 00 00 00                                  ......

10  192.168.0.101:1231  74.86.171.139:9871  14  Send  
0000  85 D2 30 73 93 93 0B 00 00 00 8E 00 00 00          ..0s..........

11  74.86.171.139:9871  192.168.0.101:1231  2  Recv  
0000  DF 39                                              .9

12  74.86.171.139:9871  192.168.0.101:1231  6  Recv  
0000  6F AD 0B 00 00 00                                  o.....

13  192.168.0.101:1231  74.86.171.139:9871  14  Send  
0000  48 D4 D2 58 AE 0A 0C 00 00 00 95 00 00 00          H..X..........

14  74.86.171.139:9871  192.168.0.101:1231  2  Recv  
0000  AE 27                                              .'

15  74.86.171.139:9871  192.168.0.101:1231  6  Recv  
0000  93 73 0C 00 00 00                                  .s....

16  192.168.0.101:1231  74.86.171.139:9871  14  Send  
0000  F5 28 05 83 34 15 0D 00 00 00 90 00 00 00          .(..4.........

17  74.86.171.139:9871  192.168.0.101:1231  2  Recv  
0000  8E 40                                              .@

18  74.86.171.139:9871  192.168.0.101:1231  6  Recv  
0000  FF 3F 0D 00 00 00                                  .?....

19  74.86.171.139:9871  192.168.0.101:1231  2  Recv  
0000  C1 05                                              ..

20  74.86.171.139:9871  192.168.0.101:1231  6  Recv  
0000  AA AC 00 00 00 00                                  ......

21  192.168.0.101:1231  74.86.171.139:9871  6  Send  
0000  30 E0 C6 09 8B CD                                  0.....

22  74.86.171.139:9871  192.168.0.101:1231  2  Recv  
0000  61 03                                              a.

23  74.86.171.139:9871  192.168.0.101:1231  34  Recv  
0000  A9 2E 00 00 00 00 01 00 00 00 0D 00 00 00 00 00    ................
0010  00 00 00 00 00 00 00 00 00 00 3D 00 00 00 00 00    ..........=.....
0020  10 C1                                              ..

And this is the code I got when I took out WoWBeez tokens (the 15th and 16th are the tokens)

1  192.168.0.101:1231  74.86.171.139:9871  22  Send  
0000  28 BC 20 A5 FB 57 ED 15 00 00 00 00 10 F1 3F 0B    (. ..W........?.
0010  18 00 18 46 31 29                                  ...F1)

2  74.86.171.139:9871  192.168.0.101:1231  2  Recv  
0000  08 71                                              .q

3  74.86.171.139:9871  192.168.0.101:1231  22  Recv  
0000  F9 DC 3F 0B 18 00 02 00 00 00 00 00 00 00 18 46    ..?............F
0010  31 29 0C 00 00 00                                  1)....

4  74.86.171.139:9871  192.168.0.101:1231  2  Recv  
0000  F7 DC                                              ..

5  74.86.171.139:9871  192.168.0.101:1231  81  Recv  
0000  A7 E8 01 00 00 00 01 02 8F 18 46 31 29 40 01 18    ..........F1)@..
0010  18 46 31 29 00 00 00 40 02 5F 43 20 00 00 00 00    .F1)...@._C ....
0020  0C 18 46 31 29 00 00 00 40 03 00 00 00 03 D9 00    ..F1)...@.......
0030  00 00 00 80 3F 67 AC 0C 00 7D 87 2C 29 00 00 00    ....?g...}.,)...
0040  50 0C 00 00 00 01 00 00 00 2C 01 00 00 2C 01 00    P........,...,..
0050  00                                                 .

6  74.86.171.139:9871  192.168.0.101:1231  2  Recv  
0000  6A CB                                              j.

7  74.86.171.139:9871  192.168.0.101:1231  35  Recv  
0000  54 54 01 00 00 00 01 00 8F 7D 87 2C 29 50 03 00    TT.......}.,)P..
0010  00 00 00 00 00 00 00 00 00 00 30 18 46 31 29 00    ..........0.F1).
0020  00 00 40                                           ..@

8  192.168.0.101:1231  74.86.171.139:9871  6  Send  
0000  42 7D 94 0F C0 A1                                  B}....

9  74.86.171.139:9871  192.168.0.101:1231  2  Recv  
0000  09 8F                                              ..

10  74.86.171.139:9871  192.168.0.101:1231  6  Recv  
0000  C4 47 00 00 00 00                                  .G....

This is the code for 500G (when taking it out of mailbox)

1  192.168.0.101:1231  74.86.171.139:9871  18  Send  
0000  8D 7E DC 92 F4 35 ED 15 00 00 00 00 10 F1 3F 0B    .~...5........?.
0010  18 00                                              ..

2  74.86.171.139:9871  192.168.0.101:1231  2  Recv  
0000  DB 27                                              .'

3  74.86.171.139:9871  192.168.0.101:1231  14  Recv  
0000  40 42 3F 0B 18 00 01 00 00 00 00 00 00 00          @B?...........

4  74.86.171.139:9871  192.168.0.101:1231  2  Recv  
0000  F7 40                                              .@

5  74.86.171.139:9871  192.168.0.101:1231  201  Recv  
0000  CB 52 01 00 00 00 01 00 07 67 AC 0C 2E 00 00 00    .R.......g......
0010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
0020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
0030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
0040  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
0050  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
0060  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
0070  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
0080  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
0090  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
00A0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
00B0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
00C0  00 00 00 20 00 36 37 D8 04                         ... .67..

6  192.168.0.101:1231  74.86.171.139:9871  6  Send  
0000  B7 FD 33 37 EC 6C                                  ..37.l

7  74.86.171.139:9871  192.168.0.101:1231  2  Recv  
0000  A8 02                                              ..

8  74.86.171.139:9871  192.168.0.101:1231  6  Recv  
0000  FE 39 00 00 00 00                                  .9....

Good luck finding a good filter

[arigity]

packets are encrypted and can't be resent, also if you mean you want to take the same item out of the mail an unlimited amount of times it won't work. and i don't think there is any possible exploit with gold (although i never bothered looking)

[poloivan]

Script o matic decrypted the Habbo Hotel packets, so, why we can't decryp WoW packets?

Is it really difficult?

[opticalza]

cannot be done
The core protects against this....

Secondly, decrypting packets isn't a problem, but changing the opcode will cause the client/server encryption key to become bad and you will be disconnected. because every packet opcode/length sent changes how the next packet will be encrypted.