• Troy McClure (unregistered) in reply to Schnitzel

    The new "code" is from right here...

    http://lordnick.proboards6.com/index.cgi?board=introduce&action=display&thread=1018399396&page=4#1020689979

  • ailaG (unregistered)

    That popup doesn't necessarily mean JS - they could have used AJAX to verify the password at the server's side.

    But they didn't.

  • Hackster (unregistered)

    OK, so I entered 'test' as a password, was able to do a search, and selected only Florida in the State field of the search criteria. Here is what came out:

    "Your search did not match any ads.

    Could not find images: You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near 'exists(select 1 from dbimg_ImageAttributeValue iav where iav.a"

    So either the server side is programmed about as well as the web page, or else no companies in Florida were stupid enough to fall for the scam?

    SQL injection, anyone?

  • gVee (unregistered)

    Seriously, just go to this url to "hack" the site

    http://www.federalsuppliers.com/test.html

  • lantastik (unregistered)

    Forgot the plethora of already mentioned WTFs, I haven't seen that much static HTML since 1995.

  • l33t (unregistered)

    is this the "new" page? of suppliers?

    http://www.federalsuppliers.com/gallery.html

  • BridgeTroll (unregistered) in reply to FEDERAL SUPPLIERS GUIDE CUSTOMER SUPPORT

    You, sir, are a certain kind of special. First off, it's not "hacking" if you can figure it out by viewing page source. Secondly, I highly doubt an organization without the technical brainpower to secure a page beyond javascript-based password prompting would have the wherewithal to "get our info" so quickly - sorry, charlie, but subpoenas don't go through THAT quickly.

    And for the love of Christ, could you PLEASE learn the difference between "of" and "have"? It's should have, not should of. How people with such a poor grasp of the English language manage to land and keep jobs is beyond me. Oh, wait, I almost forgot - sales doesn't require intelligence or a real education.

  • (cs) in reply to ailaG
    ailaG:
    That popup doesn't necessarily mean JS - they could have used AJAX to verify the password at the server's side.

    But they didn't.

    1. Of course it does. There's no AJAX without JS, see? That's what the J in AJAX stands for!
    2. You're right, this could be done - but as Alex wrote: the popup appearing that fast can only mean it's client-side validation. AJAX would most probably have taken a little longer.
  • (cs) in reply to Mexi-Fry
    Mexi-Fry:
    Checking the Script node under FireFox DOM Inspector for this stupid site. I thought you guys might get a kick out of this. It appears that they left some useful information on their 404 page. Of course... you have to HACK their site to read it... but oh well.

    <HTML> 2<HEAD> 3<TITLE>404 Not Found</TITLE> 4</HEAD> 5<BODY> 6<H1>Not Found</H1> 7The requested document was not found on this server. 8<P> 9<HR> 10<ADDRESS> 11Web Server at federalsuppliers.com 12</ADDRESS> 13</BODY> 14</HTML> 15 16<!-- 17 - Unfortunately, Microsoft has added a clever new 18 - "feature" to Internet Explorer. If the text of 19 - an error's message is "too small", specifically 20 - less than 512 bytes, Internet Explorer returns 21 - its own error message. You can turn that off, 22 - but it's pretty tricky to find switch called 23 - "smart error messages". That means, of course, 24 - that short error messages are censored by default. 25 - IIS always returns error messages that are long 26 - enough to make Internet Explorer happy. The 27 - workaround is pretty simple: pad the error 28 - message with a big comment like this to push it 29 - over the five hundred and twelve bytes minimum. 30 - Of course, that's exactly what you're reading 31 - right now. 32 -->

    A bit of Googling suggests that this is stock boilerplate text from the Plesk control panel, which FSG has previously been noted as using.

  • ebay (unregistered) in reply to More

    THAT IS AMAZINK!

    I just entered my "special" password "http://www.ebay.com/index" and it appears that the list has been replaced by Ebay, who knew you could purchase federal supplies there.

  • Urlsy (unregistered)

    Just so you don't have to play catchup with their "clever" password schemes, here are some core urls;

    List of ads sorted by Name: http://www.federalsuppliersguide.net/?_orderBy=name

    Individual ad (enumerate imageId if you wish): http://www.federalsuppliersguide.net/?_orderBy=name&imageId=4221

    Individual ad (by name): http://www.federalsuppliersguide.net/?_name=Spwipes

    And finally the not surprising proof that you could just use SQL injection to steal the entire database: http://www.federalsuppliersguide.net/?_name=%25&_description=%25&_q1=1&_q2=52&_q3=156&_orderBy=name

    Your search did not match any ads.
Could not find images: You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near 'exists (select 1 from dbimg_ImageAttributeValue iav where iav.a

    CAPTCHA: Mummy ate my monster!

  • Inno (unregistered) in reply to Whitey
    Whitey:
    John:
    sweavo:
    snoofle:
    Police, fire and EMS radio frequencies are restricted for use by those personnel, yet courts have ruled that you can buy a scanner, and listen to, but not intrude on their conversations.

    Anyone who publishes a web page should have some clue that the underlying source (especially jscript) is visible to all who know to look for it. If they are stupid enough to put a username/password in something that is essentially publicly viewable, then they don't get to bitch that the public views, then uses this information. If they don't want you to use it, they should not make it accessible.

    All very nice in principle, but the (technical) idiots are in charge, so you'll find the wording makes it illegal to bypass measures INTENDED to keep you out, whether or not they are laughably inadequate.

    Capcha: appellatio (is that like sucking off a fruit?)

    The real-world analog of this is like putting locked door in the park, without having any wall or fence attached, not even land mark.

    The trick here is that the "confidential" site is not protected and is accessible without any need for user validation. You don't even have to use the username and password. Literally you can open it just by opening the URL. I won't be surprised if the page could be found in google cache too. There are precedents where companies have left private data on publicly accessible places and this data have been accidentally found by users and copied. One such case is described in "Hacking Democracy" HBO documentary.

    Please notice that the article author doesn't say he have used the password to enter the site, so he is safe.

    To complete the analogy... They put a sticky note next to the door nob telling you the key is under the mat.

    I think it would be good if the people listed on all those pages were somehow contacted and pointed back to this site. I'm sure most of them are obvlivious to the fact that they have been scammed.

    A better analogy is that they put the key in a park but forgot to put the door!

  • Bob Holness (unregistered) in reply to FEDERAL SUPPLIERS GUIDE CUSTOMER SUPPORT
    FEDERAL SUPPLIERS GUIDE CUSTOMER SUPPORT:
    thank you hackers for trying to destroy federal suppliers guides reputation. i have worked here with my wife for 10 years now and have helped hundreds of clients obtain federal government work. i have 4 children and though you don't care you are hurting the feelings of many good employees and customers by your immature actions. sorry our site wasn't protected to your standards however all of you are being reported to the appropriate authorities as we have your information too. you should of protected your info a little better. not only is the company legit we actually have held a 5 year GSA contract with the federal government and one of my best clients just broke 500,000 dollars in federal sales directly related to the GSA contract we got them. i am proud to work here and help small businesses obtain government workand also help federal buyers locate qualified small businesses to do business with. if you not interested in government work or our services of helping small businesses navigate the federal market fine but please don't slander the company. its rude, your comments are not truthful we are not a scam and i hope someday you realize that all you have to do is check us out with dun & bradstreet or GSA or the florida local and state chambers of commerce to see that what we do is real and federal buyers do request both our hardcopy guides and the online directory as well.

    It is 'should have' not 'should of'. Otherwise the posting could use a little more white-space, perhaps the odd paragraph break.

  • (cs) in reply to Bob Holness
    [image]

    Isn't there a function to disallow comments on an article?

  • (cs) in reply to Troy McClure
    Troy McClure:
    The new "code" is from right here...

    http://lordnick.proboards6.com/index.cgi?board=introduce&action=display&thread=1018399396&page=4#1020689979

    interesting that the code they took is called "Cut-N-Paste JavaScript" but then says it has a copyright. Does he want the code to be copied or not?

  • Stenvne (unregistered) in reply to Franz Kafka

    Hey Franz...

    To clarify the term Public Domain usage. I am aware that the content of the page is copyright protected, however the usage of the content is not. As long as an individual were to give credit and reference the source, which has been done in this instance, it is not protected by any other means. Why is this true? Because the information (code) was sent to an individuals internet browser on request without requiring special security or authentication to acquire it. In other words it has been provided without charge or special privilege into the public domain.

    If you disagree please be kind enough to elaborate.

    Respectfully Submitted,

  • blub (unregistered)

    Yay :D

    [ http://www.federalsuppliers.com/warning.html ]

    <!-- // **** You WILL NOT get access without a valid password **** var suffix = ".html" // **** javascript:IPcatch:subject?Source_code_violator **** var pass_msg = "Password: "; function go_there() { location.href = document.pass_form.pass.value + suffix; } document.write('<form name="pass_form" onSubmit="go_there();return false">' + pass_msg + '<input type="password" name="pass" size="20" value="">' + '&nbsp;<input type="button" value="Verify" onClick="go_there()"></form>'); // -->
  • Khat (unregistered) in reply to More

    lmao. Yeah. Glanced at the code and the first thing I thought was "just rabbit the damn list page" http://www.google.com/search?q=site%3Awww.federalsuppliers.com)

    Seventh link on the list.

    XD

    These guys are pro. It's kind of fun to use their little 'password' box to navigate to various pages around their site.

    If they get paid that much for each client then they ought to get a webmaster that can handle a little server-side code. FFS...

  • dumbo (unregistered)

    http://www.federalsuppliersguide.net

  • GSA contractor (unregistered)

    I get calls from them. Their sales people call me and start off with some absurd question like, "would you accept a no-bid contract for up to $100,000" or something like that. They won't stop reading their script when I try to interrupt them with some question like, "are you calling from a federal agency?" I've never signed up with them, because everyone knows, or should know, that Federal buyers shop on GSAAdvantage, and GSAAdvantage is free for all GSA contract holders.

  • LMAO (unregistered)

    What's up with this form?

    http://www.federalsuppliers.com/form.html

    I can't figure out where I'm supposed to enter my company name.

  • Edgard Castro (unregistered) in reply to More

    It's "secure" now because you need an unique password. If you type something it redirects you to a non-existing page.

    But hey, wait... Let's just try something... What about "test"?

    Uh-oh. What? It worked.

  • Steve S. (unregistered) in reply to Jay

    Back when I was an over the road trucker (I came off the road in 2002), all I had to do to listen to cell phone calls was turn on my Bearcat 800 scanner and set it to frequency roam. I was always picking up cell phones, especially in the 800 - 900 mHz range. I didn't even have to tweak the scanner; it worked that way right from the factory.

  • ssparacino (unregistered) in reply to FEDERAL SUPPLIERS GUIDE CUSTOMER SUPPORT

    they may have held a gsa but that ended more than 7 years ago....they don't tell you probably 90% of companies never get a single call from thier guides..thats why they dont want you contacting thier clients most sign up for a year and never again.once they realized they were duped....thank god new companies are formed every year(pool of new suckers) once they take your money and put a ad in thier guide thier job is done.as someone who worked for them before...just like first commentator...we know all the lies they have people tell to get your money

    FEDERAL SUPPLIERS GUIDE CUSTOMER SUPPORT:
    thank you hackers for trying to destroy federal suppliers guides reputation. i have worked here with my wife for 10 years now and have helped hundreds of clients obtain federal government work. i have 4 children and though you don't care you are hurting the feelings of many good employees and customers by your immature actions. sorry our site wasn't protected to your standards however all of you are being reported to the appropriate authorities as we have your information too. you should of protected your info a little better. not only is the company legit we actually have held a 5 year GSA contract with the federal government and one of my best clients just broke 500,000 dollars in federal sales directly related to the GSA contract we got them. i am proud to work here and help small businesses obtain government workand also help federal buyers locate qualified small businesses to do business with. if you not interested in government work or our services of helping small businesses navigate the federal market fine but please don't slander the company. its rude, your comments are not truthful we are not a scam and i hope someday you realize that all you have to do is check us out with dun & bradstreet or GSA or the florida local and state chambers of commerce to see that what we do is real and federal buyers do request both our hardcopy guides and the online directory as well.
  • Sabkor (unregistered)

    Everything always seems to happen in pairs... Here's another company now accusing someone of "hacking" their site, just because they found a URL that wasn't secured:

    hxxp://www.dslreports.com/shownews/MobiTV-Threatens-HowardForums-Shutdown-92429

  • Matt (unregistered)

    I entered 'test' just to see what it would do if I got the wrong password. Turns out it was the right password. WTF indeed.

  • Michel Rouzic (unregistered) in reply to FEDERAL SUPPLIERS GUIDE CUSTOMER SUPPORT

    You're kidding right? You can't even start your sentences with a capital letter or use an apostrophe and your comment is filled with typos characteristic of the way teenagers write ("should of"? Get outta here!), how do you want to be taken seriously?

  • (cs) in reply to jpers36
    jpers36:
    T $:
    We're at 712 comments and climbing. Could this be the most popular post of all time?

    This one is still well ahead, and I'm not even sure if that's the record.

    Oh, I just love to bring this back as an example of why basic reading comprehension is important. (It's on 830+, btw -- some of which, bizarrely, date from 2008. And none of those add anything remotely worthwhile. We are sad people, out here.) But here goes:

    iron:
    DavidN:
    I know that you won't see this reply, but I have to say it anyway. It's not a 50/50 chance. The reasons have been stated and thoroughly explained several hundred times over the eighteen pages of this continuing debate.

    Please, please - I hope this is the last post on this quite frankly distressing thread.

    What reason? The 2/8 nonsense?

    According to the logic you are supporting, if I flip two "heads" in a row, and then flip again, it will be a "tails" most of the time! Or if two of your friends flip the same, does that mean you will flip the other most of the time? Of course not. Try it.

    Each coin toss (or hat colour) is independent of others.

    Having said that, has anyone found a solution to the hats problem? The one person guessing with a 50/50 chance seems to be the best solution.

    Um. No, it's not. Hint: there is a difference between tossing coins (or even yourself, given a large proportion of the 830+), and wearing hats.

    Can we stop this now?

    Can we stop that now?

  • Vartan Christopher Simonian (yes, my real name) (unregistered)

    rofl?

    Anyone could make their site secure, even a 13-year old. And I'm not just saying that because I'm thirteen, too. :P There must be people 9 or 8 years old who can protect these websites.

    It's a shame - I hope that if any legal situation arises (and it seems to already have) that they are proven wrong. I saw a comment here about google search returning the "secret" page - that doesn't seem too smart.

    Interestingly, the design of the website isn't too bad - I like it. But the programming beneath it sucks, and I'm not bringing any news to the table.

  • whatever (unregistered) in reply to More

    listing gives you how to USE the guide, gallery gives you the guide ITSELF. Basically the password is just the name of the file the guide is, so go to google and type in inurl:federalsuppliers and it will give you all of the "passwords" you need.

  • whatever (unregistered) in reply to More

    Scratch that, all you need to do is go to federalsuppliers.net. In order to secure their website, they changed the domain and made a new login page as a diversion. Real sneaky.

  • whatever (unregistered) in reply to whatever

    sorry(again) but I don't have an edit button. Maybe you can clean this up later. It is federalsuppliersguide.net

  • JS (unregistered)

    Now moved to the oh so secret location of agents.federalsuppliers.com/agents.html no password required

  • Rob W (unregistered)

    Another quirky thing I noticed: that sample ad they sent you has a recent copyright notice at the bottom... but the ad is from 1986.

    Delcowire has been in business for 12 years! That's right: since 1974.

  • Rob W (unregistered)

    Note to Federal Suppliers Guide: you don't need to do anything complicated. You don't need a database, and you can stick with plain old HTML on your server. Just use standard password authentication for this section of your website.

    Google something like ".htaccess user authentication" to find instructions.

    It seems like you're hosted with RackSpace -- pretty expensive for what you actually need! ..but I'll bet they'd be happy to set it up for you if you're having trouble.

    I'd suggest giving different clients different passwords, but you can even just go back to one username & one password (just choose them carefully).

  • Susan (unregistered) in reply to Fry-kun

    Love the "wasted money" graphic they have on their front page ---- seems pretty appropriate for their services.

  • Mike (unregistered) in reply to More

    Saw that same thing in the code but get this. They are just appending whatever you type in the "password" box to a redirection on the server. To get in, just type in the word test and wham you can search their database of ads. Has their programmer seriously never heard of SERVER side authentication? I mean come on.

  • adwin (unregistered) in reply to More

    they are getting smart rightnow lol ... :p

  • fastersec (unregistered) in reply to More

    hehe .. !! is very simple to see what page is going to be the ****.html

    google "site:officers.federalsuppliers.com" you will find a lot of pages if the page has taken offline you still can view it on cache.. these post is very funny while they will never scape to google cache until they made a full site re-implementation

  • Bob Gill (unregistered)

    Whats funny is network security consultants aren't that expensive for an operation thats that "large". You also know that their not defrauding you cause they would have more common sense if they were.

  • Bill (unregistered) in reply to More

    He grabbed that new fancy password code from a geocities site and didnt give the author credit... classy!

    http://www.geocities.com/o3wishes/TIPS.html

  • (cs) in reply to Bill

    Man, these guys are ON TOP OF THINGS! As soon as someone finds the new way to access the list, IT CHANGES!

    Wait, what does that mean for people who paid to be listed on the site?

    It must be hell to deal with these people.

  • Kyle (unregistered) in reply to More

    http://www.federalsuppliers.com/listing.html

  • rotorootr (unregistered) in reply to FEDERAL SUPPLIERS GUIDE CUSTOMER SUPPORT

    You fail.

  • ajmac (unregistered)

    This make me laugh real hard. Reading the comments i thought that this is just a joke. So i tried to open the site.

    http://www.federalsuppliers.com/warning.html

    looking at the "secure javascript code" it made me realize that it is quite secure... but my grandmother told me that i should type "listing" in the password input fields.

    what is this any federal listing anyway?

  • bob the builder (unregistered) in reply to FEDERAL SUPPLIERS GUIDE CUSTOMER SUPPORT

    Your a tool no one in your company cares if you have been hacked also you said you held that means it is past tense so you no longer have it and the comments were truthful this is some ones opinion so that is fact and if you want your website "Hacked" get real security so it will be fun to rip your site up and go ahead and pull my info I have randomized my info and am will probably come up as being a twelve year old girl

  • Inurbanus (unregistered) in reply to bob the builder

    Bob, learn2type. And in-ter-punc-tu-ate!

  • my (unregistered) in reply to More

    A clever way to disguise the name of the page in a password: http://www.federalsuppliers.com/listing.html

  • hire someone (unregistered) in reply to FEDERAL SUPPLIERS GUIDE CUSTOMER SUPPORT

    dear fsg,

    i think its time to hire someone to upgrade your site to beef up your security, even if it's just your secure area.

  • Dan (unregistered)

    I just wanted to say thank you to the Daily WTF for this article. Recently I started a new company and we filed with the CCR, just before I read this article. Only one day after filing I received a call from...guess who...Federal Suppliers. I respectfully told them I had not interest in their "product."

    Thanks again for saving me time and money.

Leave a comment on “So You Hacked Our Site!?”

Log In or post as a guest

Replying to comment #:

Log Out

« Return to Article