Xat/How-to

<Xat

This was posted in a xat thread here and stayed up for two years before Xat staff finally got their shit together enough to quit hosting a how-to hack guide on their own site (That, or the thread just expired years later because we all know Xat has no staff). Rather than go through web archive after web archive, I just pasted it below for a handy guide for newfag bruteforcing.

Here is a large variety of glitches

Posted by demademademadema 243 days ago (Editorial)

First there are 3 codes like click the thing to the left of it and click allow) Open chat again in differnt tab or window. You may also sign into the second with a alternative account and that allows you to make a 3rd. You may also use this to Snakeban Self.

There are also unban hacks like, clearing all cache files changing ip, or going to a different ip for a few hours and don't sign in or sign in an alt. ^I use xat at school and home so i figured it out

Another recently discovered glitch is how to clone yourself on xat. First, right click the chat box and click settings. Then slide the local storage bar to 0kb. Finally, open the chat in another window/tab. If you sign in with a toon name, it worked. Congratz.

Main Owner hack, this one is VERY SERIOUS. I have a friend who does it and i know most of the steps 1) get the ID XC CN GB GN

http://prntscr.com/27bb3

id=5 xc=2336 cn=1472578924 gb=g0&gn=xat_test

would be the xat_test chat

next you need to open a brutus engine and fill it in like so:

http://prntscr.com/27bbq

Target is xats ip which you get from cmd.

http://prntscr.com/27bbx

Type is HTTP (Form) Port for xat is 80 Connections=10 Timeout=10 No Proxy Method=Get Keepalive Fake Cookies Encode

Next you Click the modify sequence button http://prntscr.com/27bcc

Target form is the edit page http://xat.com/web_gear/chat/editgroup.php?GroupName=xat_test would be xat_test

next click the learn form settings button and change the form to the first one labeled "Pass" Also Click the username value and click the groupname value and then click password and click the password button. http://prntscr.com/27bcr http://prntscr.com/27be0

PHPSESSID will be same but write down the value of the value

Field Slot is Username i don't know the name though i think it would be Xat_Test but this part I'm unsure about because i have never done it i was only taught about it from a friend who left xat a while ago who proved it works so there are 2 areas i don't know how to fill out.

It should now look like this http://prntscr.com/27be8 Press Ok

User ID would probably be the chats ID but i don't know this part yet. I do know you set it to single user. Next you set the method to brute force. Fill that area in like this. http://prntscr.com/27beq Then after click Start and the pw value will appear here. http://prntscr.com/27bex

those are all the values you need now. What i am doing is creating all the values needed to recreate the main owner code. http://prntscr.com/27biv

http://xat.com/web_gear/chat.php?id=&pw=

You just need the id and pw, we have the id from the start and we use the other values in that engine to get the pw, i don't know 100% how to do it but my friend did it all the time while she was on xat so i would look into it. Then fill in the code with the values. pw value is what you got form brutus. Boom your main owner. This should be fixed.

The next glitch thingy i am going to say is about the events power. It works by having a quick loading screen that checks what account you are logged into , if you pause it there a username bar will appear, you type in the name of someone who has the power and click the button and it gets you in. its because all the unregistered users share the "null" account which is what xats system calls it. The shortname null is actually buy-able which means that if someone buys that name and gets events all unregistered and toons can sue events. http://prntscr.com/27bkt

Another glitch , this one i like, is fullscreen chat. I know it works in IE9 and Firefox 4-5 but i haven't tested the others. http://www.xatech.com/web_gear/chat/chat.swf?id=&gn= Fill in the values i showed earlier and its fullscreen http://www.xatech.com/web_gear/chat/chat.swf?id=5&gn=xat_test is an example http://prntscr.com/27blk

The gn can be changed and it will appear different in the chat http://www.xatech.com/web_gear/chat/chat.swf?id=5&gn=Demahack http://prntscr.com/27blz If you click the button 2x it will load normal chatpage. No Photobucket or youtube can be loaded because of the applications being gone. You can hold shift while clicking to open in new window though.

Next i want to talk about how insecure xats applications including trade They are made with shockwave flash which is downloaded then coded with php which is easily hackable seeing that there are many php hackers on xat.

DOODLE http://www.xatech.com/web_gear/flash/doodle.swf?a12

GRID http://www.xatech.com/web_gear/flash/30004.swf?g0

TRADE http://www.xatech.com/web_gear/flash/30008.swf?a9

, even trade can be downloaded, these go directly into xats system so these being downloaded and recoded don't even need to be on xats website for people to get free powers and scam the trade.

All of these hack or glitch problems are not being said to intend any harm on xat but to inform xats creators that it needs to be more secure and work better before some hacker learns to figure all these out.