Password Recovery Vulnerability [Scape]

[Sub-Zero5]

Whats up?

OK, Since a few fraudsters [like me] have been pming people on the board phishing them out of there account details, they setup the password recovery that goes thourgh a GM. the way that they reset your password however is easily manipulated. Heres what they ask for, fill in the info as you get it as we will need to PM a GM with this later on.

1. Account name:
2. Character name: (at least one)
3. Acct. email:
4. Short discription of issue:

OK, So step 4 is easy but we have no idea of any of the info for the first 3 steps do we? so we need to do a bit of sloughing.

Gathering Email

first up is finding there email, we can easily search scapes page for members email via our good old friend google, and hes tool called advanced search. go there now, the advanced search button is to the right of the text box on the google page.

now in the "search within site or domain" box put in "forums.scapegaming.com" without the quotes. and in any of the search boxes, put "@live.com" again without the quotes. now google will have given you the results, these are all members who have stupidly put in there email. open one and write down hes email.
__________________________________________________________________________

Gathering Account name

This is where things could go wrong, most people that i phished used the same password and username for their wow account as they did for there forum account, so lets hope they have done the same here too. whatever there called fill that in as the account name.
__________________________________________________________________________

Gathering Character name

I dont know if you remeber but when you signed up they required you to state your players name that you play with on there server? well thats in their profile, so fill what you find in for the player name.
__________________________________________________________________________

Short Description

You dont really need to be spefic, just put you where phished and want to recovery your password.
__________________________________________________________________________

Finally you need to pm what you have found to "Xtrodinary" without the quotes. in this format.

Account name: the one you found.
Character name: their char name.
Acct. email: email here
Short discription of issue: whatever you want here.

- they spelt description wrong

Job done! they could have fixed this by emailing you via the email you registered with, instead of pming you on the board with the account details, but im glad they dident :-)


See ya.

[Menthol8]

Im abit :S WHat is this forum? Because for a second I thought you ment pm ingame the person but inforum>? Bit :S Explain please hehe


Edit: Oh aha I needed to re-read it and needed to go to the site. Ima going to try it now.

+REP aha

[Sub-Zero5]

Im abit :S WHat is this forum? Because for a second I thought you ment pm ingame the person but inforum>? Bit :S Explain please hehe

you pm them on Scapegaming's forum.

[susy]

So is wowscape good again?

[Sub-Zero5]

So is wowscape good again?

How do ya mean? i dont actully play on scape's wow realm, i play on wowlegion, but this trick works either way.