Password Protected Source

Welcome to TDWTF Forums Sign in | Join | Help

TDWTF Forums » The Daily WTF » "Side Bar" WTF » Password Protected Source

Password Protected Source

Last post 07-10-2008 6:28 AM by Tamber-Krain. 24 replies.

Page 1 of 1 (25 items)
	Sort Posts: Previous Next

07-05-2008 2:09 AM

tc386
Joined on 07-05-2008
Posts 1

Password Protected Source

Reply Contact

Check out the source code of this site. "mopedsonline.com" I cant tell if it is a joke or for real!

Hint: Look at the first comment in the source code then scroll down a little bit.

07-05-2008 7:16 AM In reply to

Kilrah
Joined on 07-04-2007
Posts 28

Re: Password Protected Source

Reply Contact

ROFL. Too bad, his awesome protection doesn't work on a fullscreen window on a 1920x1080 screen...

07-05-2008 8:53 AM In reply to

Zecc
Joined on 06-12-2007
Posts 363

Re: Password Protected Source

Reply Contact

Who knows? Maybe something was supposed to appear between the <html> and <HEAD> tags, but we can't see it because we don't have the password.

If mixed metaphors were illegal, I'd be having an indigestion.

07-05-2008 9:04 AM In reply to

Spectre
Joined on 05-09-2007
Posts 455

Re: Password Protected Source

Reply Contact

Holy dice, MIDI at full volume! The copyright year must be generated automatically, because I don't believe no one in 11 years questioned this... this.

╩юфют√ь ёЄЁрэшЎрь яюЁр эр яхэёш■.

Visit #TDWTF @ SlashNET - the semi-official WTF IRC channel.

Filed under: myspace, MIDI, 90s, animated GIFs

07-05-2008 10:06 AM In reply to

Veinor
Joined on 01-31-2007
Posts 39

Re: Password Protected Source

Reply Contact

Nope, it's even better. The copyright year is written by <include>ing http://www.mopedworld.com/copyrightyear.js. The contents of this file?

document.write("1997-2008")

07-05-2008 10:08 AM In reply to

Jake Grey
Joined on 05-14-2008
Posts 130

Re: Password Protected Source

Reply Contact

That's probably all the security precautions it'd take to deter the kind of hacker bored enough to try and take that site down.

And what were you doing on a moped fansite anyway? I thought software engineers were all Rockers...

You can never have too much time, luck, shelf space or spare duct tape.

Filed under: Move, Funky Moped!

07-05-2008 11:38 AM In reply to

MiffTheFox
Joined on 07-03-2008
Posts 58

Re: Password Protected Source

Reply Contact

After clicking around a bit, I found their order form http://mopedworld.com/partform.htm. It seems they abandoned the traditional shopping cart interface in favor of a "tell us what you want and we'll try to buy it for you" method.

My favorite part of it is hidesource.js which seems to be designed for only IE6 and NS4

Also, after submitting the order form, I was presented with this page.

It's more likely then you think.

07-05-2008 12:52 PM In reply to

Ross
Joined on 07-05-2008
England, UK
Posts 2

Re: Password Protected Source

Reply Contact

MiffTheFox:
My favorite part of it is hidesource.js which seems to be designed for only IE6 and NS4

Nah, this legendary protection system also baffles IE7 users.

The error reporting system of the order form is quite clever really - why have I been validating my input when I can get the user to do it for me?!

07-05-2008 2:21 PM In reply to

Buzer
Joined on 09-29-2006
Posts 31

Re: Password Protected Source

Reply Contact

MiffTheFox:
After clicking around a bit, I found their order form http://mopedworld.com/partform.htm.

Also, looking at the source of the "web mistakes" form, it reveals this:
<form action="http://www.flynntechnology.com/mopedworld/procwebmistakesform.asp" method="post">
I have no idea how a "consulting" firm like that could get any customers...

07-05-2008 5:15 PM In reply to

MiffTheFox
Joined on 07-03-2008
Posts 58

Re: Password Protected Source

Reply Contact

Buzer:
I have no idea how a "consulting" firm like that could get any customers...

Their own site is a series of WTFs on it's own.

From the main page:

<!-- This script and many more are available free online at -->
<!-- The JavaScript Source!! http://javascript.internet.com -->
<!-- Original:  Arun kumar (n_arunk@hotmail.com) -->

I especially love this code:

outputstring = "&copy;" + year + " Flynn Technology Consultants, LLC"
document.write(outputstring)

The WTF is that this is in the <head> section, where document.write-ing dosen't impact the page whatsoever.

Also, by the looks of the comments in the code; the page was thrown together by an editor.

Finally, I saw they had sample code available on their site. I clicked, thinking that I'd find some WTFs, and I was greeted with an ASP error.

I do not want to view the horrors of their client sites.

It's more likely then you think.

Filed under: this site is trwtf

07-05-2008 5:40 PM In reply to

Faxmachinen
Joined on 03-19-2007
Posts 191

Re: Password Protected Source

Reply Contact

MiffTheFox:
The WTF is that this is in the <head> section, where document.write-ing dosen't impact the page whatsoever.

TRWTF is that Firefox (used to) display images from <img> tags within <head> at the top of the page.

rpar PROTON all

07-05-2008 6:53 PM In reply to

mihi
Joined on 05-10-2008
Posts 8

Re: Password Protected Source

Reply Contact

tc386:
Check out the source code of this site. "mopedsonline.com" I cant tell if it is a joke or for real!
Hint: Look at the first comment in the source code then scroll down a little bit.

some time ago, a fellow student asked me if you can password protect source code. he saw it in a "hacker challenge site" (you know, one of those websites that use javascript for "decoding" passwords and you have to understand the source to get the link for the next level) and he did not know how to bypass it. He sent me the link and I asked him why he did not just scroll down.

So, it seems there are really people that can be fooled by measures like that. And that guy knew a lot about javascript, this was level 7 or 8 of the challenge...

07-05-2008 8:21 PM In reply to

Jake Grey
Joined on 05-14-2008
Posts 130

Re: Password Protected Source

Reply Contact

mihi:
So, it seems there are really people that can be fooled by measures like that. And that guy knew a lot about javascript, this was level 7 or 8 of the challenge...

Well, I guess it's a case of hiding in plain sight. If I ever branch out into web design, I think I'm going to use this in my own code...

You can never have too much time, luck, shelf space or spare duct tape.

Filed under: The Anti-WTF?

07-05-2008 8:21 PM In reply to

Physics Phil
Joined on 03-09-2008
Posts 117

Re: Password Protected Source

Reply Contact

MiffTheFox:
I especially love this code:
outputstring = "&copy;" + year + " Flynn Technology Consultants, LLC"
document.write(outputstring)
The WTF is that this is in the <head> section, where document.write-ing doesn't impact the page whatsoever.
Also, by the looks of the comments in the code; the page was thrown together by an editor.

It is called from the body, it is simply declared there. This is, or at least was, perfectly normal coding practice for JavaScript.

Of course, using this is somewhat deceitful, but this sort of trick seems fairly common

Filed under: not a wtf

07-05-2008 8:34 PM In reply to

upsidedowncreature
Joined on 11-21-2007
Posts 159

Re: Password Protected Source

Reply Contact

Jake Grey:
And what were you doing on a moped fansite anyway? I thought software engineers were all Rockers...

OK, here's a crap site for a company that sells proper bikes that don't have the engine attached to the unsuspended mass. While I applaud the use of frames, I deplore the loss of the backward-scrolling marquee they used to have.

What if the hokey cokey really IS what it's all about?

Filed under: Frames mediate securely

07-05-2008 11:49 PM In reply to

MiffTheFox
Joined on 07-03-2008
Posts 58

Re: Password Protected Source

Reply Contact

Physics Phil:
It is called from the body, it is simply declared there. This is, or at least was, perfectly normal coding practice for JavaScript.

Of course, using this is somewhat deceitful, but this sort of trick seems fairly common

No, this was the full code:

<script language="JavaScript" type="text/javascript">
<!--

function getCopyRight(){
var dNow = new Date()
var year = dNow.getFullYear();
var outputstring;
outputstring = "&copy;" + year + " Flynn Technology Consultants, LLC"
document.write(outputstring)
}
//-->
</script>

It's more likely then you think.

07-06-2008 12:06 AM In reply to

MiffTheFox
Joined on 07-03-2008
Posts 58

Re: Password Protected Source

Reply Contact

MiffTheFox:
No, this was the full code:
<script language="JavaScript" type="text/javascript">
...
</script>

Oops did that go through?

I noticed the mistake just as I hit Post and tried to stop it before it went through.

It's more likely then you think.

07-06-2008 8:53 AM In reply to

TheRider
Joined on 03-01-2005
Zurich, Switzerland
Posts 195

Re: Password Protected Source

Reply Contact

So, what's the password?

"correcting wrongs on the internet is like subtracting 1 from infinity"

07-06-2008 9:20 AM In reply to

Zecc
Joined on 06-12-2007
Posts 363

Re: Password Protected Source

Reply Contact

Jake Grey:
mihi:
So, it seems there are really people that can be fooled by measures like that. And that guy knew a lot about javascript, this was level 7 or 8 of the challenge...
Well, I guess it's a case of hiding in plain sight. If I ever branch out into web design, I think I'm going to use this in my own code...

See also: Expert Sex Change, I mean Experts Exchange...

If mixed metaphors were illegal, I'd be having an indigestion.

07-06-2008 9:30 AM In reply to

Arancaytar
Joined on 12-02-2005
Aachen, Germany
Posts 156

Re: Password Protected Source

Reply Contact

I suppose this method of source code protection can be called "idiot-proof" in a very real sense.

A monk asked Joshu: isTrue(dog.hasBuddhaNature()) ?
Joshu replied: FILENOTFOUND

07-07-2008 1:45 AM In reply to

r3jjs
Joined on 03-13-2007
Posts 17

Re: Password Protected Source

Reply Contact

Being in the moped (two wheels, 50cc engine and *pedals*) I understand why you would have to give up a regular shopping cart in favor of "try to tell us what you need."

There are only a few brands out there who give any sort of part manuals or service manuals. For those companies, I have the interactive parts catalogue on my site and you can browse and buy right from there.

For MOST bikes, however, not only is there no documentation or references, there is no regularity either. What coil is used on this bike? Whatever coil was cheapest when THAT particular bike was made. Within the same year they can switch out dozens of major pieces, none of them interchangeable and none of them having part numbers, etc.

Most of the time I ask people to take pictures and email them to me. Oft times we can recogonize what it is, or at least tell you if we've seen one before. If we haven't, you're screwed.

Not that that excuses that website -- but it does defend the business model.

07-07-2008 11:11 AM In reply to

danixdefcon5
Joined on 01-09-2007
Mexico City, DF, Mexico
Posts 485

Re: Password Protected Source

Reply Contact

TheRider:

So, what's the password?

I'd go for "Access Denied".

What cracked me up is the hidesource.js "script"...

var message="Sorry, this website contains a foreign code which cannot be viewed with this web browser";

Security by obscurity? Instead of telling you outright "Right-click" disabled, it tells you about a "foreign code" that cannot be viewed!

Anyway, I hate those right-click disablers. Oh, and even in IE6, using the "right-click" keyboard button bypasses this "security".

07-07-2008 11:31 AM In reply to

D0R
Joined on 06-03-2008
Posts 33

Re: Password Protected Source

Reply Contact

tc386:
Check out the source code of this site. "mopedsonline.com" I cant tell if it is a joke or for real!

Gosh. It looks like it was done in 1994 and never updated since.

The subtitle in Star Wars font is especially ugly.

Filed under: May the Source be with you

07-07-2008 1:25 PM In reply to

KattMan
Joined on 10-18-2006
Posts 364

Re: Password Protected Source

Reply Contact

mihi:
So, it seems there are really people that can be fooled by measures like that. And that guy knew a lot about javascript, this was level 7 or 8 of the challenge...

I wouldn't assume he knows javascript. I mean you just got him to level 8 or 9. I bet he only gets to maybe 12 because then he runs out of friends to ask.

CAPTCHA? We ain't got no CAPTCHA. We don't need no CAPTCHA. We don't need no stinking CAPTCHA!

07-10-2008 6:28 AM In reply to

Tamber-Krain
Joined on 05-26-2008
Hell, UK
Posts 1

Re: Password Protected Source

Reply Contact

wow... very geocities-esque.

And I thought my site was bad. :/

How bizzare...

Filed under: back-to-geocities-bitch.

Page 1 of 1 (25 items)

Powered by Community Server (Non-Commercial Edition), by Telligent Systems