Forum


Detailed Guide - Clone Exploit
bcmatt wrote
at 10:37 PM, Thursday April 1, 2010 EDT
I got banned today and will take responsibility cause I've played around with it and it's a good thing to take a break from teh gaydice for a while. But before I go, I'd like to explain how easy it is to pull off the clone stunt.

The way the clone exploit works is by attacking a land that exists in kdice world but doesn't exist on the board itself. The result is you get one invulnerable land that no one can attack unless they also know how to do this exploit.

Normally every land on a board is given an integer and an attack is performed where land x attacks land y. This message is sent to the server in clear text. The original nuke played around with numbers x and y so that they pointed to nonsensical lands and resulted in the 0 attacks.

So how do you change what is sent to the server? Easy... use a program called webscarab which intercepts the message being sent from your browser to the server and allows you to tinker with it.

How do you set it up?

1. Start Web Scarab http://dawes.za.net/rogan/webscarab/WebScarab.jnlp
For documentation on web scarab -http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project#Download

2. Change your browser's proxy settings to localhost port 8008 You can only do this while webscarab is running otherwise you won't be able to properly connect to the internet.

3. When it's your turn go into web scarab and tick the box that says "intercept requests"

You'll see that any action in kdice will pop up a message with the document being sent to the server.

4. When you click attack you'll get a message like:
305http://kdice.com/gwt/F891C33ABEE14BB7989F2D4CF60AE439org.iogc.kdice.client.KGameServiceattackI12342552515

The x and y values are the 25 and 15 in the above message.
If you change the 15 to a 0 so that the message becomes
305http://kdice.com/gwt/F891C33ABEE14BB7989F2D4CF60AE439org.iogc.kdice.client.KGameServiceattackI1234255250
Then you will attack and defeate the clone land and get the NaN message on the board.

Whoever attacks the clone land wins so if someone else attacks the clone land after you they will take it over.

I'll probably get perma-ip-banned or something for posting this but I don't really care... it's been fun playing. Ryan fixed the old nuke bug when it became more public maybe he'll decide it's time to fix this nuke bug since anyone can do it.

Replies 1 - 1 of 1
M Bison wrote
at 1:47 AM, Friday April 2, 2010 EDT
Shit, you hacked my margins.
KDice - Multiplayer Dice War
KDice is a multiplayer strategy online game played in monthly competitions. It's like Risk. The goal is to win every territory on the map.
CREATED BY RYAN © 2006 - 2026
GAMES
G GPokr
Texas Holdem Poker
K KDice
Online Strategy
X XSketch
Online Pictionary