Password Checking Using Xfactor 4.2

Ok I am not sure what exactly is happening here but I am checking
some sites and Xfactor 4.2 is returning the site is good but
when I manually check it the site is bad. Quite possibly this
is a bug with xfactor 4.2

For some reason xfactor 4.2 is being fooled during the check to think
a site is good

Here is an example

http://diddi:monimo@biggestdickinporn.com/members/HOTMtemp/
Site was being marked as a good site when really it wasn't it appears to
be randomly happening it is something the creators of Xfactor will
definately want to look into. This is not a good thing.

I have also included a screenshot of this occuring along with this
report so you can see it for yourself. A good number of these pases were
already dead. But they were being marked as valid this was done immediately
after the site was tested.

Justme

[sPlico]

It's a fake :) Prolly slipped through x-factor's fake engine. Nothing to worry about, except that you'll have few fakes :)

Originally Posted by sPlico

It's a fake :) Prolly slipped through x-factor's fake engine. Nothing to worry about, except that you'll have few fakes :)

The problem is It is not just a few it is a lot. I am verifying huge lists and I can come up with a quarter of my list being fakes. Some one needs to look at the fake engine not working right then. It isn't just one or two here and there. When I am verify my lists it ends up being about 25% of my list end up being fakes and I have to manually go though and check it and I am finding a quarter of my list is dead already due to this fake problem.

I believe they need to improve the fake engine then because it is missing a lot.
I have the fake engine set at 3 checks too like it is recommended.


Justme

[sPlico]

Quite possible. Sites come up with new ways to "fake" the hits and delude the bruteforce engines. For the coder, when he arrives, you can just name some sites here that threw you alot fakes (not passes, just base urls).

Originally Posted by sPlico

Quite possible. Sites come up with new ways to "fake" the hits and delude the bruteforce engines. For the coder, when he arrives, you can just name some sites here that threw you alot fakes (not passes, just base urls).

Ya because when you are looking at a 150K URL list and approximately 25% of the list seems to be going bad that means there are about 37,500 bad passes some where on my list and it is pissing my users off. Which is not a good thing.

Anyways here are some base URLS which were chucking a fair number of fakes.

http://biggestdickinporn.com/members/HOTMtemp/
http://www2.penthouse.com/private/index.html
http://www.blacksonblondes.com/membersarea
http://www.gloryhole.com/membersarea/
http://members.sexmoviestoday.com/
http://members.sexcamlive.com/
http://members.seeasians.com/
http://members.realhardcore.com/
http://members.realitypass.com/
http://members.realhugecocks.com/
http://members.sexuncensored.com/
http://www.auntjudys.com/secure/mhome.htm
http://www.autumnsparadise.com/members/index.html
http://www.babylonxxx.com/members
http://www.big-titts.com/members/index.html
http://www.bigcocksex.com/members/
http://www.bigtitbimbos.com/members/
http://www.cyber-stars.com/members/

That should be a pretty good list for the coder to start figuring
out what the fake engine is being fooled into thinking the sites
are good.

Another bug I noticed is I am not sure if the fake engine is even
checking to ensure the site is even password protected in the first place.
If it isn't password protected then it should come back as bad instantly
I found one that some how got on my list that isn't password protected
and it came back as good? Shouldn't it immediately detect that it was not
password protected and kick it back as a bad site.

http://www.curvydreamer.de/

I belive this should work with any URL that is not a password protected URL
long as the URL is valid right now it is comming back as a valid site. They need to have it check to see if it is indeed password protected or not. It should be possible for them to check.

Justme

Originally Posted by sPlico

Quite possible. Sites come up with new ways to "fake" the hits and delude the bruteforce engines. For the coder, when he arrives, you can just name some sites here that threw you alot fakes (not passes, just base urls).

Any word from the coders yet as to what the problem is with the fake engine and why it was being fooled so much?

Justme

[sPlico]

No, no word from the coder. He's quite busy so he comes when he comes, we dont know when's that.

Few answers:
Engine is probably not checking is the site pass protected because it asumes it is. All testing tools i've seen don't check this option.
150k url list? You're kidding me right? What you gona do with checking that many passes? That really makes no sense.

Originally Posted by sPlico

No, no word from the coder. He's quite busy so he comes when he comes, we dont know when's that.

Few answers:
Engine is probably not checking is the site pass protected because it asumes it is. All testing tools i've seen don't check this option.
150k url list? You're kidding me right? What you gona do with checking that many passes? That really makes no sense.

Well they should never assume anything. I am running into this a fair bit. Where the site was using the old .htpass system which is easy to crack. And they found they had been hacked so they panic and switch to system where you have to login via a webpage to make it more secure. The problem is unless the password checker is checking to see that it is being asked for a login and password or not and if it isn't then the site is immediately being set as a valid login when really it isn't any more because it is just at the login page and infact isn't even asking for the login and password in the popup box any more. So then you end up with a bunch of sites which are not really valid any more still on your list which is not a good thing.

So really it does make a lot of sense for the program to check to make sure that it is being prompted for the login and pass and if it isn't and they changed thier login system the password shouldn't automatically be set as valid site. I have a lot of them in my list right now and it is driving me mad. Just because other password checkers don't do it does not mean it is a good thing. It would a great way to improve XFACTOR by putting in that feature. You can be cutting edge and
be the first to do it. It would improve the program a lot and make the lists a lot cleaner. I am running into this a lot and iti s driving me crazy!

An example of this would be

http://uperlini:barolo@members.freshauditions.com/members/
http://stattsp1:badios@www.sneak-a-peak.com/members/home.htm

And I have a huge list which I have to maintain right now it is down to about 138,000 passes on the list. It does make sense just trust me.

Anyways for now till they get this issue fixed up I am using another program too called Scholar. http://sentinel.deny.de/ Its another really good program out there.

Justme

[sPlico]

Originally Posted by justme

And I have a huge list which I have to maintain right now it is down to about 138,000 passes on the list. It does make sense just trust me.

Lol. I sincerelly doubt you have 138k working passes that you "maintain". But anyway, those points that you mentioned. Some are valid, some are totally way off. But, im not the coder, you need a coder to see this to fix certain issues. I hope he'll come and see it.

sometimes when i check my passwords that it says not working, when i mannually check it, it works.

also sometimes when I check it and it says working, I manually check it and it doesn't work.

Im im not even sure it the passes work or not anymore.