Global Moderators

Maybe not for you - but for at least 3 other guys I know

Why do you ask here and/or even ruri for this?
If you follow the rules then either you or the one who allowed you to do such stuff on his website should know the answer.

Quote:

IMPORTANT! Performing (D)DoS attacks or credential stuffing on sites you do not own (or you do not have permission to test) is illegal!

And illegal stuff is not allowed here.

Yep. Exactly

OB relies for the CF Bypass on some external library.
The Issue is already reported there https://github.com/csharp-leaf/Leaf.xNet/issues/53
But until they fix it - or some other good library which can be easily implemented pops up, I'm afraid that the problem will show up on more and more sites

jojodat created this issue in csharp-leaf/Leaf.xNet

open CF Bypass not working on some sites #53

yep - it seems other pbkdf2 seem to don't care about the recommended length of 64 bit for a salt.

we love you meinname. what a cutie

a 32 Byte Random String encoded in Base64.

Why not just Function Randomstring + Function Base64Encode ?

@ruri I think It is meant generate the nonce for OAuth
though I noticed that some implementations don't want totally random nonces but stuff like

FUNCTION CurrentUnixTime -> VAR "TIME" 
FUNCTION Hash MD5 "<VARWITHUSERNAME><VARWITHPASSWORD><TIME>" -> VAR "MD5NONCE" 
FUNCTION Base64Encode "<MD5NONCE>" -> VAR "BASENONCE" 
FUNCTION Substring "0" "32" "<BASENONCE>" -> VAR "NONCE" 

Seen this to be used in "real world"

kek kek kek (10 chars)

Or even do stuff like I did on one config:
convert to unixtime, get current unixtime and compare

Here an example I used on a config

PARSE "<SOURCE>" JSON "expires_at" -> VAR "EX" 

FUNCTION DateToUnixTime "yyyy-MM-dd HH:mm:ss" "<EX>" -> VAR "UXACC" 

FUNCTION CurrentUnixTime -> VAR "UXCURR" 

KEYCHECK BanOnToCheck=FALSE 
  KEYCHAIN Custom "EXPIRED" OR 
    KEY "<UXACC>" LessThan "<UXCURR>" 

yeah I think - if I remember correctly what I learned many years ago, RSA needs either Exponent and Modulus OR the Key (public to encrypt/private to decrypt)
So needing all 3 seems to be a bug - I already informed @Ruri about this