CABAL PANEL EP 33+

[amiidotcom]

I don’t think this has anything to do with DBeaver as it works perfectly fine on my end.

The concern is that the app isn’t fully local only. It communicates with an external backend you control while requesting direct SQL credentials, which naturally raises trust and security questions.

it never work on local ip if trying to use online services

 

[+GODMode]

it never work on local ip if trying to use online services

It just doesn’t work if it also doesn’t work in

To view the content, you need to sign in or register

.

 

[amiidotcom]

It just doesn’t work if it also doesn’t work in

To view the content, you need to sign in or register

.

you are wrong . its will work using dbeaver . but u are hosted online not offline . so for local will never work to connect online service.

 

[ep33when]

you are wrong . its will work using dbeaver . but u are hosted online not offline . so for local will never work to connect online service.

So meaning not safe ths sir ami?

 

[+GODMode]

you are wrong . its will work using dbeaver . but u are hosted online not offline . so for local will never work to connect online service.

Good for you that it worked on DBeaver. Based on my experience, it didn't work for me. Some users reported to me that it didn't work either, so I decided to try it out. I asked for their IP, username, and password, and I tried to log in on DBeaver, but none of them worked.

So meaning not safe ths sir ami?

I've built it safely, but since it's hosted online, I understand people having trust issues, and I don't blame them.

 

[amiidotcom]

Good for you that it worked on DBeaver. Based on my experience, it didn't work for me. Some users reported to me that it didn't work either, so I decided to try it out. I asked for their IP, username, and password, and I tried to log in on DBeaver, but none of them worked.


I've built it safely, but since it's hosted online, I understand people having trust issues, and I don't blame them.

i think u have 0 knowledge about access online/offline server.

it wont work if use ip = 192.168.xx.xxx blablabla cuz its local ip not public

 

[josueinaki]

This is not “localhost” or “offline.” It is an Electron (Nativefier) wrapper that opens a remote web page and makes it look like a desktop app.

What happens technically:

• The app creates an Electron BrowserWindow.
• It then calls loadURL(appArgs.targetUrl), and your targetUrl is
  To view the content, you need to sign in or register
• When you “log in,” you are actually logging into a web application hosted on Render. Your PC establishes outbound TLS/443 connections to the internet. The IP you saw is just the server/CDN/edge address that serves that site.

So, from the user’s perspective it looks like an “offline executable,” but from the system’s perspective it’s basically a bundled browser loading a website.

Also note: this template can automatically execute any scripts placed in inject/*.js , so it’s worth checking that folder to ensure nothing is intercepting credentials, cookies, or network calls.

WARNING:
This app steals your database information.
his app sends your database credentials and data to an external server.

 

[+GODMode]

This is not “localhost” or “offline.” It is an Electron (Nativefier) wrapper that opens a remote web page and makes it look like a desktop app.

What happens technically:

• The app creates an Electron BrowserWindow.
• It then calls loadURL(appArgs.targetUrl), and your targetUrl is
  To view the content, you need to sign in or register
• When you “log in,” you are actually logging into a web application hosted on Render. Your PC establishes outbound TLS/443 connections to the internet. The IP you saw is just the server/CDN/edge address that serves that site.

So, from the user’s perspective it looks like an “offline executable,” but from the system’s perspective it’s basically a bundled browser loading a website.

Also note: this template can automatically execute any scripts placed in inject/*.js , so it’s worth checking that folder to ensure nothing is intercepting credentials, cookies, or network calls.

WARNING:
This app steals your database information.
his app sends your database credentials and data to an external server.

I never denied it’s hosted online, but just wow, some of those claims.

 

[josueinaki]

I never denied it’s hosted online, but just wow, some of those claims.

When the user clicks “Login,” the database credentials and IP address are sent to your host. So yes — you are STEALING the database information entered in this panel.

MORE CLAIMS TO YOU SR.

Even though it looks like a normal program, it is basically a built-in browser that loads a website.

Two things stand out:

1) It approves permissions automatically
If the page asks for access (for example: microphone, camera, location, notifications, etc.), the app is set up to approve it instead of showing the normal “Allow / Block” choice.

Risks:
- The page could access your microphone/camera/location without you clearly agreeing.
- It may enable tracking (location, device access) that an offline-style app should not need.
- It lowers the chances you notice something unusual, because you do not get the usual permission popups.

2) It can capture your screen or a window
The app includes code that lets the page start screen/window sharing. In some cases it may even pick a screen automatically, which makes it easier for screen capture to start.

Risks:
- Anything visible on your screen (passwords, admin panels, database tools, private chats) could be captured.
- The capture could be used to copy sensitive information you never typed into the app itself (for example, things open in another window).
- It increases the impact if the page is compromised or untrusted, because screen content is high-value data.

Why this matters
If the page it opens is not fully trusted, these settings can be used to collect more information than a typical offline program should ever need.

 

[MentaL]

C:\Windows\system32\wscript.exe "C:\Users\Bruno\AppData\Local\Temp\Cabal Panel-win32-x64/resources/app/lib/main.js
C:\Windows\system32\wscript.exe "C:\Users\Bruno\AppData\Local\Temp\Cabal Panel-win32-x64/resources/app/lib/preload.js
C:\Windows\system32\wscript.exe "C:\Users\Bruno\AppData\Local\Temp\Cabal Panel-win32-x64/resources/app/lib/static/login.js

navigator.mediaDevices.getUserMedia({
video: { chromeMediaSource: 'desktop' }
});