Hacker News Reader

Comment by donohoe | Hacker News Reader

If I were that scammer I'd quickly see I can likley filter out all accounts added within such a short burst of time following convention of <name><number>@yahoo.com

Also, my guess is most users don't have that pattern of password...

View on HN

It would be probably another 5 minutes to add: random delay and a thread pool, a file with Xk most common passwords, random user agent from another file, bunch of email domains, select at random, append numbers to local part when ... [bunch of conditions].

Another half an hour to deal with the IP address stuff.

But, I think the purpose of the video was to show how to use the requests library.

How would you deal with the 'IP address stuff'? If you plan on harvesting SOCKS proxies or using existing lists, your adversary can just check IPs against DroneBL.

Hey, I’m sure that video does not show how to build an anti-scammer solution. The scam stuff seems to be a nice back story for showing some python stuff. OTOH, any time a scammer is required to go and look at the data, write filters and what not, it’s a win!

True.

It's interesting to look at from the other perspective though, normally we're on the side trying to prevent malicious users and in this thread we're thinking as the 'malicious' user.

I thought the form fields were suspicious. The scammer may already have something in place that generates random user/pass form fields, and even random endpoints by the look of the url.

The "engineer" didn't check this, which he could have easily done by simply refreshing the page. But if the scammer did have any sort of protection, the engineer would have had a lot more work in it for him, having to scrape the page.. so maybe he purposely ignored this red flag.

I think he did check it and the video we saw was the fast version of this process for the sake of the viewer.

But that’s just what my instincts tell me based on the time spent investigating, the amount of useful snippets, and the lack of typos and errors while coding.

There's no need to put engineer in quotes. This video wasn't an in-depth how-to; it was just a quick proof-of-concept.

It wasn't meant as an attack. I don't know his name, but his channel is called engineer-something, so I meant it as "engineer-something".

Although I do think, for a learning video, that he missed out on a lot of opportunity to explain such things as I mentioned.

I checked out the page myself, and the endpoints and form fields are the exact same for me.

Also, there's some funny exposed PHP code sent along:

    <?php
    session_start();
    ?>

And some packed javascript that does nothing because it's "commented out" with  inside the <script> tags, meaning it has syntax errors.

filtered by IP and Useragent.

Also seems some kind of ID is encoded in the URL he got redirected to after visiting the initial link, as well as the field names.

Reply on news.ycombinator.com