RE: Hacking WoW Database question

[jinktreek]

Hey guys, I'm new to these fourms and I just had one question. I know that proggrams like T-search and cheat engine are able to change stats but only on the client side. When people have asked questions about those proggrams users have replied saying that in order to change stats you would have to hack into the Blizzard server. However, they never said if this was possible or not, im assuming its immpossible but I just wanted to put the question out there. If it is not impossible then I'm assuming its quite difficult.
P.S. Would have posted it in a hacking sect of the forms but most of them specifically say: "NO QUESTIONS HERE"
Thanks for reading my question

[Clovian]

For any of us to do it, it would be impossible.

[jinktreek]

alrighty, thats what I would think. Ty for posting! Do you know who would be able to do this besides blizz =P thanks lol
also, can anyone explain to me why it would not be possible? sorry for the stupidity but just trying to MAKE SURE that it is totally impossible for anyone.

[imtakinusrs]

Well, it could technically be possible, if the both the login server AND the target realm server would be compromised to allow remote execution of code. In sucn an extreme case, one who is knowledgeable in SQL (if that indeed is the database type that's being used for login and characters alike) could probably consult whichever content he/she desires.

However, such an attempt would quickly be noticed by Blizzard, and if they can somehow link the attacker to his account, rest assured said account will be banned with extreme prejudice.

Possible? Yes, although the "odds vs risk" ratio sucks too much for anyone to consider this a viable option. Moreover, chances of vulnerabilities being found are slim to none.

[jinktreek]

Thanks a bunch for the clarification there!
-imtakinusrs: Refer to PM

[jinktreek]

I was going to PM imtakinusrs, but unfortunately I do not have the privaledge to send PM's quite yet so....
ill just have to post my stupid questions here.
- Well, i just have a few questins regarding your last post (as you guys have probably noticed I am quite un-knowlegable about most of this stuff, so feel free to laugh at me
1. What is the difference between the "realm server" and the "login server," when you said that, did you mean the login screen (where you enter your account name/password to login to your account) and the actuall realm, (like ghostlands/dunemaul ect.) Or were you reffering to something else? (sorry once again)
2. What kind of server vulnerabilities would one be looking for to hack into the database? (like the server crashing?)
3. WARNING, THIS QUESTION IS VERY NOOB-ISH: what programm would I have to use to execture code into a blizzard server once a vulnerability is located?
4. I am willing to put a lot of my time and effort into learning the SQL code, but to start me off, does anyone know any good tutorials online?
Thanks much for your time and support, I am very appriciative of anyone who actually took time and answered my questions! TY!

[Clain]

1. Logon/Auth server handles logon packets and authentication process until handshaking. The Realmserver is the character screen + ingame world.
2. ?, I think you answered your own question!
3. A database manager... they use Oracle so you'd need an oracle client.
4. SQL isn't hard to learn, you don't really need tutorials.

Their database is possible to hack into, but who would change their stats when you could get access to every GM account/player accounts, wipe it, or basically do anything you want.

If you DID get access to their database, You'd probably have a million+ lawsuit on you with cops at your door to take your computer or even arrest you >.>

[jinktreek]

Thank you so much for your input, I just have two quick things
1. Would the code for hacking into their database be extremely long and complex
2. I know that there are some hacks that enable someone to crash servers, could that be used to "create" a vunerability?
Wouldnt want to go to jail 0_o

[Clain]

What you see with C++ is memory in the client/server being edited. (Or is it server only :X)
You'd have to find flaws in their system, maybe disassemble the client(Not needed really in this case) and look through that, or even trying to bruteforce it. To "hack" it you need the database credentials AND the server the SQL database is hosted on. It might not even allow remote access. Some of this probably isn't right since thats just some observations/inferences I took.

[jinktreek]

lol... lots of infoim not quite familiar with but... Ill go ahead and look into it some more online and see what I can come up with, thanks for the help!!

[Clain]

Sorry but in my honest opinion, if you don't have knowledge of the interal parts of WoW and other information the chances are 1/101031002031932103.

[jinktreek]

well, how in the world would someone acquire that information?
willing to take that chance =P

[Clain]

Maybe Cyhper, Kynox, Apoc, etc could tell you more or something, I'm most likely leading you in the wrong direction by now.

[jinktreek]

rofl, alteast your leading me IN a direction
trial and error bro
this could take me a month or two years, i dont rly care

[jinktreek]

hey do u have an AIM screen name or something where we could chat more about this?