-
You MUST read the Babiato Rules before making your first post otherwise you may get permanent warning points or a permanent Ban.
Our resources on Babiato Forum are CLEAN and SAFE. So you can use them for development and testing purposes. If your are on Windows and have an antivirus that alerts you about a possible infection: Know it's a false positive because all scripts are double checked by our experts. We advise you to add Babiato to trusted sites/sources or disable your antivirus momentarily while downloading a resource. "Enjoy your presence on Babiato"
Stake - Online Casino Gaming Platform | Laravel Single Page Application | PWA v1.21.0 Untouched
- Thread starter halobandungkuh
- Start date
I will share how to null it (bypass license code and domain restricts) and all its addon if I have latest version (1.19)
Ok so based on the codes you are sharing here
The class is requesting an API call, to set the response
This is a setup class so can be by passed this way
this will pass on to installation ... but apparently there is another domain check somewhere ?
Honestly, its unlikely for me to check the rest if the code is not shared by someone ...
If someone shares I can publicly try to help and post code edits here.
The class is requesting an API call, to set the response
This is a setup class so can be by passed this way
Code:
public function register($code, $email, $hash = NULL)
{
try {
// Simulate the API response
$response = (object) [
'success' => true,
'message' => '00000000000000000000000'
];
return $response;
} catch (\Throwable $e) {
return (object) ['success' => FALSE, 'message' => $e->getMessage()];
}
}Honestly, its unlikely for me to check the rest if the code is not shared by someone ...
If someone shares I can publicly try to help and post code edits here.
1.15.6 license bypass
First, edit "packages/installer/src/Services/InstallerService.php.
/**
* Display installation step form
*
* @param Request $request
* @return \Illuminate\Contracts\View\Factory|\Illuminate\Http\RedirectResponse|\Illuminate\View\View
*/
public function view(Request $request, $step)
{
// don't allow direct access to routes via GET, only through redirect
if ($step > 2 && !$request->session()->has('app_redirect')) {
return redirect()->route('install.view', ['step' => 1]);
}
return view('installer::pages.step' . $step, [
'step' => $step,
'title' => $this->steps[$step]
]);
}
Find this code and replace 1 with 2
Then enter the following url for installation: yourdomain.com/install/2
Last edited:
it looks like doing same thing ive posted in a different approach, that also bypasses installation
I have their crypto competitions am trying to make work (i do have a license)
But their scripts also have a hostname protection I cannot find by any regex search, at this point am more interested in learning the method to be used and applied
My findings so far : when bypassing installation either way, it will write to env
PURCHASE_CODE=0
SECURITY_HASH=1
LICENSEE_EMAIL=0
Installation works, and the only route that works is : /login or /register
Frontend and backend do not, and return blank screen
If i access host from licensed hash hostname it works, if i change hostname it breaks
If i access host from licensed hostname, and change hash it also breaks
Somewhere it is checking and comparing hash generated by their
app/Services/LicenseService.php and DotEnvService.php to hostname
Logically, at some point in the code, it also generates a hash based on purchase code and licensee email, and compares it to security hash , if that hash is different it exits.
But cannot find that .. or it could be simpler and still cannot find what breaks non valid hostname check
I have their crypto competitions am trying to make work (i do have a license)
But their scripts also have a hostname protection I cannot find by any regex search, at this point am more interested in learning the method to be used and applied
My findings so far : when bypassing installation either way, it will write to env
PURCHASE_CODE=0
SECURITY_HASH=1
LICENSEE_EMAIL=0
Installation works, and the only route that works is : /login or /register
Frontend and backend do not, and return blank screen
If i access host from licensed hash hostname it works, if i change hostname it breaks
If i access host from licensed hostname, and change hash it also breaks
Somewhere it is checking and comparing hash generated by their
app/Services/LicenseService.php and DotEnvService.php to hostname
Logically, at some point in the code, it also generates a hash based on purchase code and licensee email, and compares it to security hash , if that hash is different it exits.
But cannot find that .. or it could be simpler and still cannot find what breaks non valid hostname check
apparently they use same method on their scripts to verify URL versus hosted script
So if you pass installation, it will still do a hash check on url and will compare it to what the has is supposed to be on that hostname even if ur installation is continued and done.
I was able to fully bypass this for one of their scripts ( a stocks competitions ) and verify usage after installation.
So I am confident with the method, if anyone uploads a non null updated script of it here, casino/stake/competitions i will gladly remake it and reupload it within the day to work
preferrably any version working on php8+ not old scripts they have (php7).
So if you pass installation, it will still do a hash check on url and will compare it to what the has is supposed to be on that hostname even if ur installation is continued and done.
I was able to fully bypass this for one of their scripts ( a stocks competitions ) and verify usage after installation.
So I am confident with the method, if anyone uploads a non null updated script of it here, casino/stake/competitions i will gladly remake it and reupload it within the day to work
preferrably any version working on php8+ not old scripts they have (php7).
for example for this uploaded one to bypass installation you only need to adapt app/Services/LicenseService.php
to
ok here is an update, this version is worthless, i installed it despite knowing its old, but the files has zero games besides a single bacarrat game.
to
<?php
namespace App\Services;
use Exception;
use GuzzleHttp\Client;
use function GuzzleHttp\json_decode as jsonDecode;
class LicenseService
{
// public function register($code, $email, $hash = NULL)
// {
// try {
// $client = new Client(['base_uri' => config('app.api.products.base_url')]);
// $response = $client->request('POST', 'licenses/register', [
// 'form_params' => [
// 'code' => $code,
// 'email' => $email,
// 'domain' => request()->getHost(),
// 'hash' => $hash ?: config('app.hash')
// ]
// ]);
// return json_decode($response->getBody()->getContents());
// } catch (\Throwable $e) {
// return (object) ['success' => FALSE, 'message' => $e->getMessage()];
// }
// }
public function register($purchaseCode, $email)
{
$response = '{
"success": true,
"message": ""
}';
return json_decode($response);
}
// public function download($code, $email, $hash, $version)
// {
// try {
// $client = new Client(['base_uri' => config('app.api.products.base_url')]);
// $response = $client->request('POST', 'products/download', [
// 'form_params' => [
// 'code' => $code,
// 'email' => $email,
// 'domain' => request()->getHost(),
// 'hash' => $hash,
// 'version' => $version
// ],
// ]);
// return $response->getHeaderLine('Content-Type') == 'application/zip'
// ? (object) ['success' => TRUE, 'message' => $response->getHeaderLine('Security-Hash'), 'content' => $response->getBody()->getContents()]
// : json_decode($response->getBody()->getContents());
// } catch (\Throwable $e) {
// return (object) ['success' => FALSE, 'message' => $e->getMessage()];
// }
// }
public function download($code, $email, $hash, $version)
{
$response = '{
"success": true,
"message": ""
}';
return json_decode($response);
}
}
ok here is an update, this version is worthless, i installed it despite knowing its old, but the files has zero games besides a single bacarrat game.
Last edited:
That method work fine for install. But onlu Baccarat card game inside that caisno. And mainpage is empty/
if anyone provides the untouched, its easy to null now, i got the encryption hash override for both installation and blank screen output after installation.
Tested on this provided one and competitions script, works great .. just old scripts, but i imagine they use same or similar works on new ones too ( supposing someone provides the untouched)
Tested on this provided one and competitions script, works great .. just old scripts, but i imagine they use same or similar works on new ones too ( supposing someone provides the untouched)
update please, v1.21.0
CHANGES HISTORY
---------------
v1.21.0 - 18 August 2023
- Option to disable email authentication (in favor of web3 or OAuth).
- Game cards responsiveness improvements.
- Minor bug fixes.
CHANGES HISTORY
---------------
v1.21.0 - 18 August 2023
- Option to disable email authentication (in favor of web3 or OAuth).
- Game cards responsiveness improvements.
- Minor bug fixes.
