Chat Exploit

My boy (I don't know what else to call em, cause I closed the IM by accident, you know who you are, IM me so I can give you creds) told me about a lil exploit that would allow you to send a message to a chatroom before you actuly enter it. The easiest way to exploit this is to join a chatroom, and while its loading the room copy and paste something into the text box, and hit enter, do this multiple times, and a few of your messages will be sent to the room before you actuly join it.

Roughly - I belive this is possible because of sockets, The AIM server keeps track of the sockets it is using for each client, and the AIM Client also keeps track of the sockets in the same way. Now, because both the client and the server know what socket they are goign to use, before they even use it, it is possible to send a message to a chatroom, before you actuly enter it, because as long as you get the verification that you are allowed to join the room, it doesn't seem to matter that the messages were sent before that verification was recived, the server probably thinks that your client was lagged, and it didnt get the message quickly enough, and as long as the verification was sent, it will send the messages to the chatroom. Now I assume that this all takes place during the short period of time between when the server sends verification that you can join the room, and the time it takes the packet to get to your computer. So the server does not know when the client received it, but it knows that it was sent, and allows the messages your sending to the chatroom through, before you actuly join it. Or, it could be something else, thats my take on it.

I now know, that it is possible, in oscar atleast to do it, by not sending the a return packet to the server saying you are ready to chat, you enter the room, can send, but timeout in about 10 seconds.

-Nemisis

Click here to go back