{"id":1531,"date":"2021-01-27T00:00:00","date_gmt":"2021-01-26T23:00:00","guid":{"rendered":"https:\/\/demo.sidekick.be\/itenium\/first-hack\/"},"modified":"2025-11-28T13:31:44","modified_gmt":"2025-11-28T12:31:44","slug":"first-hack","status":"publish","type":"post","link":"https:\/\/demo.sidekick.be\/itenium\/blog\/design\/first-hack\/","title":{"rendered":"First Hack"},"content":{"rendered":"

The Strategy<\/h1>\n

\"Ambar<\/p>\n

During one age of the browser game Ambar, we were playing an empire in which our strategy was to grow like mad but without training any troops. If we could outgrow everyone fast enough, no one would be able to open a magical portal to our empire to attack us, since portal-opening was based on empire size. This was kind of the idea because as you can guess, having no troops in a war game usually is.. problematic.<\/p>\n

The Portal<\/h1>\n

And\u2026 Turns out we hadn\u2019t grown enough, fast enough because right after the initial no-attack period an enemy empire did succeed in opening a portal to us \ud83d\ude32.
Usually this is not really a problem, as there is a spell to close a portal should someone open one to an \u201cundesirable\u201d target – in our case any<\/strong> other empire.<\/p>\n

Unfortunately, for our \u201cstrategy\u201d to work, we all needed to pick a certain race providing us with the correct perks and bonuses during registration. And of course this race did not posses the capability to cast the \u201cClose Portal\u201d spell. At this point, we were ready for the slaughterhouse.<\/p>\n

The Hack<\/h1>\n

Casting a spell in Ambar was as simple as selecting it from a dropdown menu:<\/p>\n

<select>\n    <option value=\"0\">No Spell Selected<\/option>\n    <option value=\"1\">Divine Sight<\/option>\n    <option value=\"4\">Echos of the Past<\/option>\n    <option value=\"6\">Open Portal<\/option>\n    ... and more spells ...\n<\/select>\n<\/code><\/pre>\n
And all I did was save the Html locally, add the spells not available to my race to the <select><\/code> and add a little <base \/><\/code><\/a> tag.<\/p>\n
<base href=\"http:\/\/www.darklights.com\/cgi-bin\/game\/login\">\n<select>\n    <option value=\"7\">Close Portal<\/option>\n    ... and all other spells in game ...\n<\/select>\n<\/code><\/pre>\n
And \ud83d\udca5, the portal closed, our empire saved from those heinous invaders and me wondering why they didn\u2019t do this little check on the backend.<\/p>\n
I did get an IM from someone of the attacking empire asking how exactly we managed to magically close the portal since no one in our empire had the required race to do so \ud83d\ude09<\/p>\n
The Conclusion<\/h1>\n
All user input is evil.<\/p>\n
Have a backup plan in case risky plan A goes awry.<\/p>\n
I\u2019m a cheat and should\u2019ve been banned.<\/p>\n
Extras<\/h1>\n
Stuff that came into being during the making of this post<\/b><\/p>\n