Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Cheating too easy / Security problem #1

Open
3j14 opened this issue Jul 5, 2016 · 2 comments
Open

Cheating too easy / Security problem #1

3j14 opened this issue Jul 5, 2016 · 2 comments

Comments

@3j14
Copy link

3j14 commented Jul 5, 2016

It's fairly easy to change the code on runtime. Just open developer option (e.g. in Chrome with cmd + alt+ i) and edit the client.js file.

I replaced
if( userInput != game ){
in Game.prototype.verifyAnswerwith
if( 1==0 ){
and reached a top score of 234. I could have played it forever clicking anything and it will always be correct.

You should consider using a server side game engine. But then you can't use github pages.

@3j14
Copy link
Author

3j14 commented Jul 5, 2016

The first thing you can do is writing a gulpfile to minify the js file. It's not "hackproof" or something like that but a step in the right direction.

You can find an example here.
(npm and gulp required)

Also, you should never ever make your firebase APIKey publicly visible.

Happy coding 😉 you got this :)

@3j14 3j14 changed the title Cheating too easy Cheating too easy / Security problem Jul 5, 2016
@bognarlaszlo
Copy link

bognarlaszlo commented Jul 6, 2016

Another "hack" is possible:

var newscript = document.createElement('script');
      newscript.type = 'text/javascript';
      newscript.async = true;
      newscript.src = 'https://ajax.googleapis.com/ajax/libs/jquery/1.12.4/jquery.min.js';
      (document.getElementsByTagName('head')[0]||document.getElementsByTagName('body')[0]).appendChild(newscript);

var rightEl = $('#rightText');

var leftKeypress = $.Event('keydown', { keyCode: 37 });
var rightKeypress = $.Event('keydown', { keyCode: 39 });

function arrowTrigger(direction) {
    switch (direction) {
        case 'left':
            $('#game').trigger(leftKeypress);
        break;
        case 'right':
            $('#game').trigger(rightKeypress);
        break;
    }
}

function hackSite() {
    if( rightEl.css('display') == 'none' ) {
        arrowTrigger('left');
    } else {
        arrowTrigger('right');
    }
}

function startHacking() {
    setInterval( function() { hackSite() }, 100 );
}

function stopHacking() {
    for (var i = 1; i < 99999; i++)
        window.clearInterval(i);
}

startHacking();

I've got bored at 4766 points

One way could be if you make RIGHT/LEFT words appear in canvas maybe.

Anyways nice. Keep up the good work. ;)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants