Silk Road forums

Discussion => Silk Road discussion => Topic started by: warweed on January 30, 2012, 09:03 am

Title: SR user search utility - another bot inovation by warweed
Post by: warweed on January 30, 2012, 09:03 am
http://warweedoeg6lfyoz.onion/search/

There is still going to be some work done to it in the next 48 but yeah pretty much enter w.e you want to enter and it will search my db for that user name or uid the search utility is 100% always up to date :)

but yeah this is just 1.0 :) I will work on cleaning it up a bit make things linkable ect. I also plan to make it carve data on the fly

I suggest you bookmark it :) because alot of times your like shit whats such and suchs profile it happens trust me :)

anyways enjoy :) try not to abuse it to much because I can see your searches if it starts to get abused i will just take it down 
Title: Re: SR user search utility - another bot inovation by warweed
Post by: redforeva on January 30, 2012, 09:06 am
http://warweedoeg6lfyoz.onion/search/

There is still going to be some work done to it in the next 48 but yeah pretty much enter w.e you want to enter and it will search my db for that user name or uid the search utility is 100% always up to date :)

but yeah this is just 1.0 :) I will work on cleaning it up a bit make things linkable ect. I also plan to make it carve data on the fly

I suggest you bookmark it :) because alot of times your like shit whats such and suchs profile it happens trust me :)

anyways enjoy :) try not to abuse it to much because I can see your searches if it starts to get abused i will just take it down
Warweed thanks  :)
Title: Re: SR user search utility - another bot inovation by warweed
Post by: warweed on January 30, 2012, 09:08 am
your welcome :)
Title: Re: SR user search utility - another bot inovation by warweed
Post by: warweed on January 30, 2012, 10:24 am
pfft half expected a few replys :( you guys suck
Title: Re: SR user search utility - another bot inovation by warweed
Post by: Silpheed on January 30, 2012, 10:36 am
Wow. I just noticed this in your sig.

Thanks a lot. It's really helpful. I've been waiting for something like this.
Title: Re: SR user search utility - another bot inovation by warweed
Post by: gazwel on January 30, 2012, 11:32 am
Nice one man :)
Title: Re: SR user search utility - another bot inovation by warweed
Post by: warweed on January 30, 2012, 11:42 am
:)
Title: Re: SR user search utility - another bot inovation by warweed
Post by: Horizons on January 30, 2012, 11:58 am
Well this looks like it's the cat's pajamas! Thanks, warweed.
Title: Re: SR user search utility - another bot inovation by warweed
Post by: warweed on January 30, 2012, 09:16 pm
your welcome :) thanks for looking :)
Title: Re: SR user search utility - another bot inovation by warweed
Post by: oso on January 30, 2012, 11:23 pm
I havent used the search function yet, but I wanted to say I really like the Up?Down link in your profile. You should let people become more aware of that. Really easy way to see if no one is getting in or just me.

THanks@
Title: Re: SR user search utility - another bot inovation by warweed
Post by: warweed on January 30, 2012, 11:28 pm
Updated to make the names linkable
Title: Re: SR user search utility - another bot inovation by warweed
Post by: warweed on January 30, 2012, 11:29 pm
I havent used the search function yet, but I wanted to say I really like the Up?Down link in your profile. You should let people become more aware of that. Really easy way to see if no one is getting in or just me.

THanks@

Thanks OSO not really sure how to spread the word more then it is :D
it will catch on sooner or later :)
Title: Re: SR user search utility - another bot inovation by warweed
Post by: BenJesuit on January 30, 2012, 11:32 pm
Fooking sweet! This and your SR status page.

You're a true asset to the community - in so many ways.
Title: Re: SR user search utility - another bot inovation by warweed
Post by: warweed on January 31, 2012, 12:04 am
thanks ben it's appreciated :)
Title: Re: SR user search utility - another bot inovation by warweed
Post by: mito on January 31, 2012, 12:06 am
shit, there are a few mito clones...   
Title: Re: SR user search utility - another bot inovation by warweed
Post by: tenderdawg on January 31, 2012, 12:23 am
warweed, you rock.
This will be really useful, thanks! Asset indeed.

I could really use a bot that monitors my head stash quantity on hand, using order history  to calculate lead times and ballpark cost, then finds the best deals using price comparison algorithms, obtains and deposits the correct amount of btc in my SR account, and finally places the orders....            ; ^)

Alternatively, being able to search based on country of origin would be really useful as well.
(and yes, the useless "undeclared" origin designation is the sand in that vagina)

Title: Re: SR user search utility - another bot inovation by warweed
Post by: warweed on January 31, 2012, 01:42 am
there will be more options added to this in the future it's kind  of a when i get to it project i would love to add so more on the fly data carving options but for now it will do since sr can't seem to build a search function that works worth shit :P

Title: Re: SR user search utility - another bot inovation by warweed
Post by: v01d on January 31, 2012, 02:01 am
Thanks Warweed. Incredibly useful for finding vendors with no listings :)
Title: Re: SR user search utility - another bot inovation by warweed
Post by: Leech on January 31, 2012, 02:13 am
Nice, you probably have talent to work as a computer script writer.
Title: Re: SR user search utility - another bot inovation by warweed
Post by: warweed on January 31, 2012, 02:48 am
cheers My scripting knowledge is limited but i'm learning more and more this project is teaching me alot actually the project as of today is now a collaboration between renton and I and plan to add functions for pgp submission and verification sr user statistics in regards to member joins and such hopefully some rough sales figures and a way to search sellers feedback easily for less then 5 out of 5 ratings rather then doing it manually and display links to that item ..

I mean all these things are way down in the future but are all thoughts we are having :) also improvements on sr's current search functions is a thought because lets face it sr's search function sucks balls .. thou that has challanges by itself
Title: Re: SR user search utility - another bot inovation by warweed
Post by: mezzrow on January 31, 2012, 03:18 am
Thanks Warweed!  Both are super useful.  I like your Up? much better than the Is It Up?....just one click!  You can't beat that! ;D
Title: Re: SR user search utility - another bot inovation by warweed
Post by: warweed on January 31, 2012, 09:37 am
Indeed i kinda made it more or less for me but then got annoyed because everyone in the silc chat would nto shut the fuck up about is it up or down so i posted it .. i just made it super simple and made the title UP or DOWN that way i could just leave the tab open and go about my work or w.e and i could see when it was up or down :) the biggest annoyance is not using java script 
Title: Re: SR user search utility - another bot inovation by warweed
Post by: atlas on January 31, 2012, 11:58 am
Thanks a lot warweed that's really useful :D
Title: Re: SR user search utility - another bot inovation by warweed
Post by: LegendaryPancake on January 31, 2012, 08:45 pm
Thanks Warweed! This and your up/down checker are extremely useful. Keep up the good work.
Title: Re: SR user search utility - another bot inovation by warweed
Post by: Leech on February 01, 2012, 01:06 am
Hey warweed if you have an idea to return the BTC exchange rate display it would be great. I think the reason SR remove that function was because if SR site gets the BTC rate update from MtGox/or where ever, SR IP address or server information would be compromised, since a connection would be needed. Is there anyway the script can be refreshed with a safe anonymous proxy?
Title: Re: SR user search utility - another bot inovation by warweed
Post by: warweed on February 01, 2012, 01:45 am
it is a work in progress sr actuallly removed it because having the exact known btc amount causing a small security issue with internal functions not because of external i will patch somthing around it
Title: Re: SR user search utility - another bot inovation by warweed
Post by: tordemon on February 01, 2012, 02:49 am
Holy shit, this is exactly what I've been asking for. Thank you so much, man.
Title: Re: SR user search utility - another bot inovation by warweed
Post by: warweed on February 01, 2012, 05:01 am
no worries :D i needed it so i made it now i share it :D
Title: Re: SR user search utility - another bot inovation by warweed
Post by: ukbenjy on February 01, 2012, 08:53 pm
Cheers warweed, this was really useful.  :D
Title: Re: SR user search utility - another bot inovation by warweed
Post by: tordemon on February 01, 2012, 11:54 pm
no worries :D i needed it so i made it now i share it :D
If I may enquire, I'm somewhat curious as to how it functions because of my programming background; where do you get the list of SR users? Is there other data that SR publishes that I don't know about?
Title: Re: SR user search utility - another bot inovation by warweed
Post by: purifiedwater on February 02, 2012, 12:12 am
MORE BOTS!!!

:)
Title: Re: SR user search utility - another bot inovation by warweed
Post by: Horizons on February 02, 2012, 01:52 am
MORE BOTS!!!

:)

I, for one, welcome our new robot overlords.
Title: Re: SR user search utility - another bot inovation by warweed
Post by: warweed on February 02, 2012, 01:56 am
no worries :D i needed it so i made it now i share it :D
If I may enquire, I'm somewhat curious as to how it functions because of my programming background; where do you get the list of SR users? Is there other data that SR publishes that I don't know about?

I was waiting for this questions lol I carved every user profile on SR for some basic info and stats and now that it's caught up it carves on the fly generally speaking if you register an account i probably carved it before you even login for the first time
Title: Re: SR user search utility - another bot inovation by warweed
Post by: warweed on February 02, 2012, 02:03 am
At time of writeing this

Quote
157431:Coronanary
.
157432:beachbum
..........
157433:navarch72
157434:ep6664000
157435:krishnalovesyou
.
157436:FoaxNews
157437:asdejaf09

is the most current users to SR  each "." represents a 10 seconds wait for instance it took 10 seconds between  krishnalovesyou and FoaxNews signing up
Title: Re: SR user search utility - another bot inovation by warweed
Post by: mito on February 02, 2012, 02:05 am
hi warweed,

are the username links supposed to work?

what about SR users, can we search there too?

cheers.
Title: Re: SR user search utility - another bot inovation by warweed
Post by: CHROOT on February 02, 2012, 04:35 am
Warweed, these two "bots" you've built are winners. Way to innovate like a boss.

If you fancy shrooms I'll send you a quarter ounce free, for the time you've put into these.

Either way, nice work!

http://silkroadvb5piz3r.onion/index.php/silkroad/user/139042
Title: Re: SR user search utility - another bot inovation by warweed
Post by: warweed on February 02, 2012, 09:10 am
hi warweed,

are the username links supposed to work?

what about SR users, can we search there too?

cheers.

they work :) for instance http://warweedoeg6lfyoz.onion/search/index.cgi?warweed
Search results for: warweed

13555 : warweed

which links to http://silkroadvb5piz3r.onion/index.php/silkroad/user/13555 :)

Title: Re: SR user search utility - another bot inovation by warweed
Post by: warweed on February 02, 2012, 09:11 am
Warweed, these two "bots" you've built are winners. Way to innovate like a boss.

If you fancy shrooms I'll send you a quarter ounce free, for the time you've put into these.

Either way, nice work!

http://silkroadvb5piz3r.onion/index.php/silkroad/user/139042

appreciate the fine offer chroot but i am more then set on boomers :)
thanks again thou :)
Title: Re: SR user search utility - another bot inovation by warweed
Post by: supersecretsquirrel on February 02, 2012, 02:27 pm
they work :) for instance http://warweedoeg6lfyoz.onion/search/index.cgi?warweed

This link is vulnerable to Cross-Site Scripting (XSS). A simple demo would be http://warweedoeg6lfyoz.onion/search/index.cgi?<script>alert("blah")</script>. You'll want to make sure that any user input after the question mark is validated before returning any results (only allow numbers and a-z/A-z for example).
Title: Re: SR user search utility - another bot inovation by warweed
Post by: warweed on February 03, 2012, 12:45 am
thanks secret squirrel are you who i think you are ? 

but yes this was identifyed prior to release it was more or less a quick utility toss together when i have time to work on it i will be implimenting a regex how ever server side the security is not a issue and the script runs thru transparent tor how ever i guess i should get of my ass and fix it up proper the problem with a regex is sr does not impliment one for user sign up so there are a bunch of special chars in usernames
Title: Re: SR user search utility - another bot inovation by warweed
Post by: supersecretsquirrel on February 03, 2012, 02:10 am
thanks secret squirrel are you who i think you are ? 

I don't know? Who do you think I am?

but yes this was identifyed prior to release it was more or less a quick utility toss together when i have time to work on it i will be implimenting a regex how ever server side the security is not a issue and the script runs thru transparent tor how ever i guess i should get of my ass and fix it up proper the problem with a regex is sr does not impliment one for user sign up so there are a bunch of special chars in usernames

Any vulnerability could /potentially/ be used to find the real IP address of the server hosting the .onion site, and could possibly also be used to attack the users visiting the site. Saying that it's just "a quick utility toss together" is a poor excuse, imo. I'm not saying the site itself sucks -- because I think it's great -- but I'm saying that releasing code that you know is vulnerable is a bad thing.
Title: Re: SR user search utility - another bot inovation by warweed
Post by: warweed on February 03, 2012, 06:50 am
Quote
Any vulnerability could /potentially/ be used to find the real IP address of the server hosting the .onion site, and could possibly also be used to attack the users visiting the site. Saying that it's just "a quick utility toss together" is a poor excuse, imo. I'm not saying the site itself sucks -- because I think it's great -- but I'm saying that releasing code that you know is vulnerable is a bad thing.

I'm quite aware of what it's capable of doing however in this situation xss will not and can not reveal my location simply due to the method in which the server was setup though feel free to try at your please and share with us what you find 

however "I guess" I can fix this the only issue really is this "<H1>Search results for: $results_ </H1> "


FIX:
simple regex to sanatize the result in the <body>
results_=`echo $1 | grep '[_-0-9A-Za-z ]'`

please continue to try and find bugs :) and thank you for pointing it out however I'm not so much concerned about my security though I do understand that security of my users is most important
Title: Re: SR user search utility - another bot inovation by warweed
Post by: warweed on February 04, 2012, 01:34 am
though please continue to test it's much appreciated i had identified the variable was not sanitized prior to release was just trying to figure the best possible route in which to do it there are a few other small quirks but they are being worked out as we speak
Title: Re: SR user search utility - another bot inovation by warweed
Post by: warweed on February 04, 2012, 05:32 am
:) I'm happy to say the search function is being fully utilized ATM im getting lots and lots of searches since this sale :D
Title: Re: SR user search utility - another bot inovation by warweed
Post by: jpisbetterthanme on February 04, 2012, 06:19 am
MORE BOTS!!!

:)

I, for one, welcome our new robot overlords.





+1 and +1 for the tiny man that sits on my shoulder, who is also excited about robots.



and @war +3 for the scripting .......


and @the SR overlords, why isn't this integrated into the actual site? =P


and @the tiny man who sits on my shoulder, you owe me $8.50.
Title: Re: SR user search utility - another bot inovation by warweed
Post by: warweed on February 04, 2012, 10:12 am
no idea why it's not integrated into the site :S
Title: Re: SR user search utility - another bot inovation by warweed
Post by: theverde on February 04, 2012, 12:00 pm
many thanks warweed, your search utility is very good!
oh, and i saw the "fuckoff" on the "homepage" ahahah :D
Title: Re: SR user search utility - another bot inovation by warweed
Post by: jpisbetterthanme on February 04, 2012, 04:41 pm
no idea why it's not integrated into the site :S

SR shoulda just hired you instead of not hiring me  ;D
Title: Re: SR user search utility - another bot inovation by warweed
Post by: warweed on February 05, 2012, 02:15 am
Lol i don't want to work for SR you kidding me I mean if he offered i would help but i would not apply at this point there is to many whiny sniveling brats complaining about the .25 btc they got ripped for I would make for very bad customer service lol
Title: Re: SR user search utility - another bot inovation by warweed
Post by: jpisbetterthanme on February 05, 2012, 05:58 am
Warweed = gets hired by SR, writes bot to automatically say "FUCKOFF" to every incoming message, ????, PROFIT.
Title: Re: SR user search utility - another bot inovation by warweed
Post by: warweed on February 05, 2012, 06:32 am
already had a automated PMing bot that every new user by the time they signed up and then logged in a new message from me was waiting for them :) infact this script was a spin of it
Title: Re: SR user search utility - another bot inovation by warweed
Post by: jpisbetterthanme on February 05, 2012, 07:40 am
That ... sounds. .... .... Dangerous..

Are you watching me right now, war?!
Title: Re: SR user search utility - another bot inovation by warweed
Post by: warweed on February 05, 2012, 09:40 am
Always ;)
Title: Re: SR user search utility - another bot inovation by warweed
Post by: supersecretsquirrel on February 05, 2012, 10:48 am
please continue to try and find bugs :) and thank you for pointing it out however I'm not so much concerned about my security though I do understand that security of my users is most important

Happy to audit more. Want to share the code?
Title: Re: SR user search utility - another bot inovation by warweed
Post by: NorCal on February 05, 2012, 09:18 pm
This is awesome warweed.  8)
Title: Re: SR user search utility - another bot inovation by warweed
Post by: warweed on February 05, 2012, 11:30 pm
Thanks to lilith2u for the .14 btc donation you are the first to donate and i really appreciate it

to reply to supersecretsquirrel

im sorry the code is closed source you may externally audit it if you choose but it does not contain and sql or anything of the like and is rather low tech and uses the kiss principle the xss was identified before release even due to it injecting the variable into the body of the page the regex stopped that 
Title: Re: SR user search utility - another bot inovation by warweed
Post by: jpisbetterthanme on February 07, 2012, 04:37 am
Hey War this is just a small nitpicky design/usability tip but what you just said about only one person donating to you made me think to tell you - On the results page after you search, you should make your name a link to your page. More people would be inclined to donate to you if they didn't have to hunt you down : )
Title: Re: SR user search utility - another bot inovation by warweed
Post by: warweed on February 07, 2012, 05:30 am
Cheers :) I updated the page I think this is what you mean :)

thanks for the input
Title: Re: SR user search utility - another bot inovation by warweed
Post by: warweed on February 07, 2012, 06:39 am
Quote
'
'
-1
-1000000000000000000000000000000
-100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
#

æøå
%nbsp;
../
<IMG
<LAYER

I wraff you wrose
Title: Re: SR user search utility - another bot inovation by warweed
Post by: supersecretsquirrel on February 08, 2012, 08:01 am
I wraff you wrose

Turns out you get a nice piece of garbage printed if you enter enough characters that the server is not expecting. Good thing thttpd can handle it. Wonder if there's a username character limit.
Title: Re: SR user search utility - another bot inovation by warweed
Post by: warweed on February 08, 2012, 08:21 am
Yeah you get a 400 error

somthing like this

Quote
UNKNOWN 400 Bad Request
Server:
Content-Type: text/html; charset=iso-8859-1
Date:
Last-Modified:
Accept-Ranges: bytes
Connection: close
Cache-Control: no-cache,no-store

<HTML>
<HEAD><TITLE>400 Bad Request</TITLE></HEAD>
<BODY BGCOLOR="#cc9999" TEXT="#000000" LINK="#2020ff" VLINK="#4040cc">
<H2>400 Bad Request</H2>
Your request has bad syntax or is inherently impossible to satisfy.
<HR>
<ADDRESS><A HREF


not so much a security risk more over no patched .. lol this is good thou you are making me work.. how ever still not a exploit or vulnerability
Title: Re: SR user search utility - another bot inovation by warweed
Post by: supersecretsquirrel on February 08, 2012, 08:36 am
not so much a security risk more over no patched .. lol this is good thou you are making me work.. how ever still not a exploit or vulnerability

True. I'll probably play nice and PM you directly if I come across something really interesting.
Title: Re: SR user search utility - another bot inovation by warweed
Post by: Oldtoker on February 08, 2012, 09:25 am
Great feature warweed.  Bitcoins on the way.  ;D
Title: Re: SR user search utility - another bot inovation by warweed
Post by: warweed on February 08, 2012, 09:37 am
thanks to OldToker for the .40 btc donation it is greatly appreciated

and SS cheers tis no big really i mean if my location is compromised it happens i don't really have much to worrie about as for a user char limit no currently there is not one in place we will be implementing both a max and min char limit fairly soon  I just have had some other projects on the go atm
Title: Re: SR user search utility - another bot inovation by warweed
Post by: warweed on February 20, 2012, 05:13 am
just thought i would give er a bumpity bump for people who haven't seen yet
Title: Re: SR user search utility - another bot inovation by warweed
Post by: jpisbetterthanme on March 04, 2012, 01:08 am
War! What now with the Stealth Mode?

PLEASE HELP US WARWEED YOU'RE OUR ONLY HOPE!
Title: Re: SR user search utility - another bot inovation by warweed
Post by: tcobambientAgain on March 04, 2012, 05:26 am
I'm high right now so maybe I'm missing something.  If I knew the vendors name why would I need to search for it using Warweeds bot?  There needs to be a bot where you can search for drugs not vendors (yes, I'm aware of the one on SR but that hides the stealth vendors so it's useless to find the drug you want from a stealth vendor).  Again, I apologize if I'm missing something on account of being fucked up. 
Title: Re: SR user search utility - another bot inovation by warweed
Post by: jpisbetterthanme on March 04, 2012, 04:10 pm
Search name => find URL => assist Warweed in taking over the world with Warbots.

YMMV . . .
Title: Re: SR user search utility - another bot inovation by warweed
Post by: Reseller on March 04, 2012, 05:12 pm
I'm high right now so maybe I'm missing something.  If I knew the vendors name why would I need to search for it using Warweeds bot?  There needs to be a bot where you can search for drugs not vendors (yes, I'm aware of the one on SR but that hides the stealth vendors so it's useless to find the drug you want from a stealth vendor).  Again, I apologize if I'm missing something on account of being fucked up.

You can only search for product names or categories with the 'search feature' built in the SR market.

Warweed, thanks for this.
Title: Re: SR user search utility - another bot inovation by warweed
Post by: norelav on March 04, 2012, 08:48 pm
Some members seem to be quite old:

Quote
has been a member for 42 years
was last seen: 42 years ago
has 0% positive feedback