[Release]USE YOUR RestServer in Other Port!!!

Results 1 to 15 of 15
  1. #1
    Member Jaeru is offline
    MemberRank
    Mar 2011 Join Date
    Puebla, MéxicoLocation
    52Posts

    [Release]USE YOUR RestServer in Other Port!!!

    NOTA: Si necesitas ayuda en español contactáme. And sorry if my english is too bad.

    Skype: yaeldd

    - FOR ADMINS: I consider this like a release because i fully made this code and i'm adding files with that code to this thread, if you think is wrong section and title please change it to the correct.
    - All the links to other threads/documents/sites i will post here, are made by their respective writers, i'm not taking credit for they work, i'm just linking to the info i think its needed to understand how this release/tutorial work.
    - You need to have a working PHP version.
    - This SQL connections work with ODBC tunneling, you should not to worry if you have the correct PHP version or SQLSRV extension for it, but you should to enable the ODBC into your PHP installation/instance, you should to search for info if you want to know more about this, for enabling extensions tutorial CLICK HERE


    This is my first release/tutorial, please be sweet with your criticisms.

    I've read a lot of explanations about how the OdinRestServer work and all those says, and in fact, the port for having it working should be the "80" port, due to this port is the WEB server port, you could wish to have both working, Rest Server and Web Server, you could simply change the port where your Web Server is listening the incoming connections but the users who visit your web should to write in the URL the port you are using, example: http://myurl.com:8080
    And that is what you won't to do anymore, right?

    Well i found a solution for this, i should to specify this substitute only has been tested for working with the client login successfully, at the moment the client ask to the web server if the received token is valid or not, you could find more info about how the full login (with full i mean to from launcher to client) system work here:
    Original info posted by @NextIdea on this thread: NextIdea commnet saying the info...
    Thread made by bruna157

    The request to the Rest Server from Login Server is something like this:
    /user/v1/getInfo?realm=fiesta&token=Jaeru&sig=510ca3d4b2ac0e05cbe9dec0aa0c1e8061d4dfdcdedd630c6a3813e9bb8e00cc
    Remember that when you set up your Server there is one step where you should to edit your "hosts" file (Windows System file you can find in: X:\Windows\System32\drivers\etc directory, where "X" mean you Local Hard Drive/Local Disk), this step say that you should to add a line with the "stubedore.t" domain redirecting it to your server IP, example:
    127.0.0.1 stubedore.t
    This was a step really required for the Login Server not for Rest Server (due to that is the Login Server "who ask" for that URL), then, the full URL to get the answer is:
    stubedore.t/user/v1/getInfo?realm=fiesta&token=Jaeru&sig=510ca3d4b2ac0e05cbe9dec0aa0c1e8061d4dfdcdedd630c6a3813e9bb8e00cc
    Or in other words (adding the web "http" protocol):
    http://stubedore.t/user/v1/getInfo?r...3813e9bb8e00cc

    And the expected answer from it is something like this:
    {"token_age":0,"user_id":1,"login":"Jaeru","user_role":"user","blocked":false}

    We will make a "script" that will allow your normal Web Server to do that, but like you can see in the request, the Login Server ask for a certain URL:
    http://stubedore.t/user/v1/getInfo?realm=fiesta&token=Jaeru&sig=510ca3d4b2ac0e05cbe9dec0aa0c1e8061d4dfdcdedd630c6a3813e9bb8e00cc

    If you already added the line to the "hosts" file you can continue.

    1. Then the first step is creating that URL in our web server, this step will depend of where your Web Root documents are saved in your Hard Disk, example:
      C:\WebDocsDir\user\v1\
      And there you should to create a file without extension with the name "getInfo"
      Maybe you are asking yourself: "And how the hell will be read this file without extension?", what make us go to the next step.
    2. If in your Web Root directory you already have a file named ".htaccess" then you just open that file and add this lines:
      Code:
      <FilesMatch "^[^\.]+$">
          ForceType application/x-httpd-php
      </FilesMatch>
      *If you don't have any file with that name you will notice you can't simply make a new one due to the OS limitations, in this case you can download files that are in the link provided at the end of this release/tutorial or in the attached files.
      This will force your IIS/Apache/WebServer to read all the documents without extension like PHP Files.
    3. Now that you added those lines, you should to go to the "getInfo" info file and edit it with any Text Editor (I recommend to use Notepad++, its Freeee!!, use Google to get it). In that file you will add the next lines of code and replace corresponding data by your own:
      NAME\SQLINSTANCE: You will replace this with your computer and SQL instance data, by example: JAERU-PC\SQLEXPRESS
      DBUsername: Replace this with your SQL username, by example: sa
      DBPassword: Replace this with your SQL password, by example: 123456
      PHP Code:
      <?PHP

      $conexion_acc 
      "DRIVER={SQL Server};SERVER=NAME\SQLINSTANCE;DATABASE=OdinAccounts";
      $con_user "DBUsername";
      $con_pass "DBPassword";

      /* ### Establish an ODBC connection with the DataBase or show a message in case of error ### */
      $conexion_rest ODBC_CONNECT$conexion_acc$con_user$con_pass ) OR DIE ('Error trying to connect to the database.');

      IF(ISSET(
      $_GET['realm']) AND ISSET($_GET['token']) AND ISSET($_GET['sig'])) {
          
      $Realm $_GET['realm'];
          
      $Token $_GET['token'];
          
      $Sig $_GET['sig'];

      /* ### Returning the answer ### */
          
      $query_lft "SELECT tAccounts.nEMID, tAccounts.sUsername FROM tAccounts, tTokens WHERE tAccounts.nEMID = tTokens.nEMID AND tTokens.sToken = '$Token'";
          
      $query_lft_exec ODBC_EXEC($conexion_rest$query_lft);
          IF(
      ODBC_NUM_ROWS($query_lft_exec) != 1) {
              ECHO 
      'NoToken: '.$Token;
          }
          ELSE {
              
      $Result ODBC_FETCH_ARRAY($query_lft_exec);
              ECHO 
      '{"token_age":0,"user_id":'.$Result['nEMID'].',"login":"'.$Result['sUsername'].'","user_role":"user","blocked":false}';
          }
      }
      ELSE {
          ECHO 
      'NO DATA FOUND!<BR />All or some of the required data was not received correctly or is undefined.';
      }

      /* ### Closing ODBC connection ### */
      ODBC_CLOSE($conexion_rest);

      ?>

    And that's all!!!
    Try to connect to your server using your login like normally you do (.BAT file or Launcher) with the RestServer stopped and you will see that this works.

    Please if you like this Release/Tutorial Support us on facebook: Aeolus Network Facebook Page
    Special thanks to Tronic due to was him who give me the idea to make this, he doesn't helped me to code it, he just gave me the idea, maybe i don't like him anymore because he deleted to me from Skype contact but i have not rancor against him.
    Thank you for reading.

    DOWNLOAD FILES: MEGA - Replace your OdinRestServer!

    - - EDITED - -

    Well the next file, is fully released by: @Gruntilda (I'm just posting the info).... this make me look like dumbass but i think is the main reason of this release....
    Quote Originally Posted by Gruntilda View Post
    @TryMeh I'm releasing this for two reasons. 1) To make you look like the dumbass you are. 2) So you don't make any money off of something that is free.
    Odin REST Server Source: http://stubedore.com/OdinRestServer.rar

    - - EDITED - -


    After a lot of negative comments about the security and functions issues in my code i had a new idea and then i said "LET'S TRY".....
    I discovered you could use OdinRestServer in other port, this will help you a lot because you are not making "security" issues and this way you avoid the "free access to the databases" in the first script I post, and this way, you will have too working your "Premium Inventory"...
    to get this working, do the same steps than before, but in step 3 replace that code by this one:
    Code:
    <?PHP
    
    IF(ISSET($_GET['realm']) AND ISSET($_GET['token']) AND ISSET($_GET['sig'])) {
        $Realm = $_GET['realm'];
        $Token = $_GET['token'];
        $Sig = $_GET['sig'];
        
        ECHO '<META http-equiv="refresh" content="0;URL=stubedore.t:8080/user/v1/getInfo?realm='.$Realm.'&token='.$Token.'&sig='.$Sig.'">';
    }
    ELSE {
        ECHO 'NO DATA FOUND!<BR />All or some of the required data was not received correctly or is undefined.';
    }
    
    
    ?>
    Where (stubedore.t:8080) 8080 is the new port where you are running your rest server, and do the same for the requested URL for the itemPurchases and all those things, maybe you are asking yoursefl: "How the f***k will i have that URL?" (rhetoric question for noobs - including me -)
    Well you can get it from the LogFile ("Requests.txt") from RestServer folder (if you have questions add me on the skype given at top of this thread), Or for advanced users, you can download the release that @Gruntilda made... look for the "RestClient.cs" class into the project (OdinRestServer source) and there are all the possible requests that the RestServer could Receive, made the "URL" for each one and replace the code by the requested, EXAMPLE:
    URLs AND PARAMETERS:
    FOR TOKEN VERIFICATION:
    Request Example: GET /user/v1/getInfo?realm=fiesta&token=Jaeru&sig=510ca3d4b2ac0e05cbe9dec0aa0c1e8061d4dfdcdedd630c6a3813e9bb8e00cc HTTP/1.1
    DATA: /user/v1/getInfo - And parameters: realm, token and sig.

    FOR PREMIUM INVENTORY REVIEW:
    Request Example: GET /store/v1/getPurchasedItems?realm=fiesta&outsparkID=2&sig=0eb36846bef4fc313893c9d8717c46b91ba385961601296d2fd9255969aa9a0a HTTP/1.1
    DATA: /store/v1/getPurchasedItems - And parameters: realm, outsparkID and sig... ETC, ETC.... you will check all the URLs and create the corresponding folders on your Web Server:
    Examples:
    For tokens: C:\WebServerRoot\user\v1\getInfo.php
    For premium inventory: C:\WebServerRoot\store\v1\getPurchasedItems.php

    For now this is just working for token, bu i will found a way to make it to with the other 2 URL!!

    And on each one you will recover the correct parameters (realm, fiesta, outsparkID, etc) and send it to the new port of your rest server like the new example... and all its done ;)
    Have fun and remember support us on Facebook: Aeolus Network Facebook Page and like the thread .... have great developing!!....
    Attached Files Attached Files
    Last edited by Jaeru; 29-03-14 at 04:16 PM. Reason: Improving the script....


  2. #2
    Member Jaeru is offline
    MemberRank
    Mar 2011 Join Date
    Puebla, MéxicoLocation
    52Posts

    Re: [Release]Replace your OdinRestServer with a PHP script!

    Ok TryMeh, I already sent you a message please read it...

    - - - Updated - - -

    Quote Originally Posted by ExtremeUser View Post
    Who can rewirte this in web.config for IIS ?

    Code:
    <FilesMatch "^[^\.]+$">
        ForceType application/x-httpd-php
    </FilesMatch>
    I think you could use something like this instead forcing IIS to read the documents without extension like PHP, but this will cause all your PHP URLs to be shown without it::

    Code:
    <?xml version="1.0"?>
    <configuration>
        <system.webServer>
            <rewrite>
                <rules>
                    <rule name="rewrite php">
                        <!-- Removes the .php extension for all pages. -->
                        <match url="(.*)" />
                        <conditions logicalGrouping="MatchAll">
                            <add input="{REQUEST_FILENAME}" matchType="IsFile" negate="true" />
                            <add input="{REQUEST_FILENAME}" matchType="IsDirectory" negate="true" />
                            <add input="{REQUEST_FILENAME}" negate="true" pattern="(.*).php" />
                        </conditions>
                        <action type="Rewrite" url="{R:1}.php" />
                    </rule>
                </rules>
            </rewrite>
        </system.webServer>
    </configuration>
    You could rewrite this to make just the "getInfo" file to be read that way, in this case you should to add the ".php" to the name on the file, then the final and full name should be: "getInfo.php".... i hope this could work, if not please tell to me....

  3. #3
    Gruntilda Gruntilda is offline
    MemberRank
    Apr 2010 Join Date
    468Posts

    Re: [Release]Replace your OdinRestServer with a PHP script!

    @TryMeh I'm releasing this for two reasons. 1) To make you look like the dumbass you are. 2) So you don't make any money off of something that is free.

    Odin REST Server Source: http://stubedore.com/OdinRestServer.rar

    Oh and thank you @TryMeh for my free sub.
    Last edited by Gruntilda; 27-03-14 at 01:33 PM.

  4. #4
    Member Jaeru is offline
    MemberRank
    Mar 2011 Join Date
    Puebla, MéxicoLocation
    52Posts

    Re: [Release]Replace your OdinRestServer with a PHP script!

    Quote Originally Posted by Gruntilda View Post
    @TryMeh I'm releasing this for two reasons. 1) To make you look like the dumbass you are. 2) So you don't make any money off of something that is free.

    Odin REST Server Source: http://stubedore.com/OdinRestServer.rar
    Woaah!!.... definitely, Stu, this makes me change my opinion about you... maybe my opinion doesn't matter to you but i'm just saying :P

    Lul... this makes me look like a dumbass too xD

    - - - Updated - - -

    Main post edited after @Gruntilda's release!
    Last edited by Jaeru; 27-03-14 at 08:12 AM. Reason: Adding funny lines...

  5. #5
    əʇılə ɯɐ ı fiestanerd69 is offline
    MemberRank
    Jun 2009 Join Date
    958Posts

    Re: [Release]Replace your OdinRestServer with a PHP script!

    Quote Originally Posted by Jaeru View Post
    Well i found a solution for this, i should to specify this substitute only has been tested for working with the client login successfully, at the moment the client ask to the web server if the received token is valid or not, you could find more info about how the full login (with full i mean to from launcher to client) system work here: Thread made by bruna157
    That source is incorrect. The original source was from NextIdea who posted that in my thread to help me create a launcher.

    Link: http://forum.ragezone.com/f594/launc...1/#post7401941

    Thanks, to everyone who posted here:D

  6. #6
    -.- NextIdea is offline
    MemberRank
    Nov 2012 Join Date
    343Posts

    Re: [Release]Replace your OdinRestServer with a PHP script!

    Quote Originally Posted by cyberghost View Post
    PHP-based launcher-login? Nice, open the doors for buggers as wide as hell :D
    Why you say that PHP code is full of bugs.
    Just make it secure enough.

  7. #7
    Enthusiast cyberghost is offline
    MemberRank
    Dec 2012 Join Date
    35Posts

    Re: [Release]Replace your OdinRestServer with a PHP script!

    Quote Originally Posted by NextIdea View Post
    Just make it secure enough.
    Every php-based login can be called by inserting the required informations (like account & (maybe) MD5 password) into the parameters. Every kid can launch bugged client.exe by starting it with the token u'll get from the php-script. If you get the valid token, no ones cares about launchers. You can download patches manually without the launcher. The bug-level is over 9000 within some hours after server launched.

  8. #8
    Member Jaeru is offline
    MemberRank
    Mar 2011 Join Date
    Puebla, MéxicoLocation
    52Posts

    Re: [Release]Replace your OdinRestServer with a PHP script!

    Quote Originally Posted by cyberghost View Post
    PHP-based launcher-login? Nice, open the doors for buggers as wide as hell :D

    @Topic:
    I dunno know why everyone is freaking out about some crappy RESTful ocde, u can use every f***ing RESTful open source code to get your own login-system Oo
    Nothing special about it, but i think this section always need some spoons =/
    LUL.... I can almost be sure you are using PHP for your server (if you even have one), if not then why are you doing criticism when you don't even have one?
    And it really doesn't matter if you have one, if you are not helping here go and shut up your mouth instead just nagging about other people "HELP"....
    If PHP wasn't secure, then, why PHP exists?
    It's not the instance, is the coder....

  9. #9
    -.- NextIdea is offline
    MemberRank
    Nov 2012 Join Date
    343Posts

    Re: [Release]Replace your OdinRestServer with a PHP script!

    Quote Originally Posted by cyberghost View Post
    Every php-based login can be called by inserting the required informations (like account & (maybe) MD5 password) into the parameters. Every kid can launch bugged client.exe by starting it with the token u'll get from the php-script. If you get the valid token, no ones cares about launchers. You can download patches manually without the launcher. The bug-level is over 9000 within some hours after server launched.
    It's whoever fault who coded like this.
    There are more secure methods to prevent that. It's not perfect but I would say it will prevent medium people from hacking.
    For advanced hackers it will take just some more time.
    Also when you implement some more security you can also start logging who starts trying to bypass it.

  10. #10
    Enthusiast cyberghost is offline
    MemberRank
    Dec 2012 Join Date
    35Posts

    Re: [Release]Replace your OdinRestServer with a PHP script!

    Quote Originally Posted by Jaeru View Post
    I can almost be sure you are using PHP for your server
    My servers run on python based login-system with Auth0.

    Quote Originally Posted by Jaeru View Post
    if you are not helping here go and shut up your mouth
    I do, by trying to prevent ppl to be as gullible like u with all your dangerous half-knowledge.

    Quote Originally Posted by Jaeru View Post
    If PHP wasn't secure, then, why PHP exists?
    Confirmation of my previous statement.

    Gimme your server adress and i show you how secure your php is =)
    But since your would cry, i'll instead help you by posting links with some real php-based REST i found in some seconds by using google:

    With some JSON https://github.com/philsturgeon/codeigniter-restserver
    Basic API https://github.com/twilio/flask-restful https://github.com/tinkerpop/rexster...Basic-REST-API https://github.com/Respect/Rest
    web service with google go https://github.com/emicklei/go-restful

    If you want more, google it sweety.

  11. #11
    Member Jaeru is offline
    MemberRank
    Mar 2011 Join Date
    Puebla, MéxicoLocation
    52Posts

    Re: [Release]Replace your OdinRestServer with a PHP script!

    Ok i sent you PM, please read it... it could be cool if someone show at least what says....

  12. #12
    Rada Rada. Delius is offline
    MemberRank
    Jul 2012 Join Date
    AustraliaLocation
    431Posts

    Re: [Release]Replace your OdinRestServer with a PHP script!

    It's a good option, like NextIdea said you can log pretty much everything.
    There are always gonna be exploits. Fix one, another one is found. We've experienced that with the 600 methods of duping.

    Overall it's a nice release and hopefully someone takes it and improves on it to make it more secure.

  13. #13
    Member Jaeru is offline
    MemberRank
    Mar 2011 Join Date
    Puebla, MéxicoLocation
    52Posts

    Re: [Release]USE YOUR RestServer in Other Port!!!

    Main Thread Updated after i had new idea, please check it, i changed the title due to is more useful....

  14. #14
    -.- NextIdea is offline
    MemberRank
    Nov 2012 Join Date
    343Posts

    Re: [Release]USE YOUR RestServer in Other Port!!!

    Why you did something like that.

    I would have expected that you will complete the script in PHP and make it secure.
    Rather than you use Rest service for it and PHP as middleman. (You still have to edit the Rest service source so the PHP has no point in here)
    The port was never the problem for free access to DB. The problem was the insecure PHP code.

    The positive side using Rest was that you didn't have to install web service. Downside was that you couldn't change the code, now that is not a problem.
    PHP good side was that you could code it however you like, but badly programmed leaved it vulnerable.

    In overall you made things more complicated.
    Also did you tested it as I'm not really sure that you can redirect Login service.

  15. #15
    Member Jaeru is offline
    MemberRank
    Mar 2011 Join Date
    Puebla, MéxicoLocation
    52Posts

    Re: [Release]USE YOUR RestServer in Other Port!!!

    Quote Originally Posted by NextIdea View Post
    Why you did something like that.

    I would have expected that you will complete the script in PHP and make it secure.
    Rather than you use Rest service for it and PHP as middleman. (You still have to edit the Rest service source so the PHP has no point in here)
    The port was never the problem for free access to DB. The problem was the insecure PHP code.

    The positive side using Rest was that you didn't have to install web service. Downside was that you couldn't change the code, now that is not a problem.
    PHP good side was that you could code it however you like, but badly programmed leaved it vulnerable.

    In overall you made things more complicated.
    Also did you tested it as I'm not really sure that you can redirect Login service.
    Thank you by having faith on me, sincerely i'm very busy right now and i should other thing to do, when i end of doing all this things i will make it, its sure i should to learn about the security... anyways this is a "quick" solve to my problem and i was looking for share it, i have here the files edited....

    - - - Updated - - -

    LoginService receive automatically answers from RestServer on the port it is listening :3
    Attached Files Attached Files



Advertisement