HOW UD GANG EXPLOITED BLOXFLIP

I was losing robux on bloxflip (as usual) until I found a feature known as Voice rooms I then told hexxa and Fluroine and Pablo (Pablo doesn't have a part in this besides suggesting stuff).

We were wondering if we could exploit this so then I opened up firefox's inspect panel and went to network tab and logged when it said create, Seen here:

I went through the cookies on bloxflip and deleted each cookie until I was logged out.

The "app.at" cookie was the auth token but I had a issue after about 3hrs the auth token would expire but I never got logged out when I entered the site normally the auth tokens just changed. So I looked for a refresh token and sure enough the refresh token was "app.rt".

Fluroine found out that instead of using a browser (which was what I was doing) we should use the API

the bot itself wasn't complicated. it was a python script that would use cloudscraper to bypass cloudflare.

it was really funny to me watching the voice rooms fill up with bots lol

curl 'https://bloxflip.com/api/voice-room/create' \
            -X POST \
            -H 'Content-Type: application/json' \
            -H 'Cookie: app.at=<auth token here>' \
            --data-raw '{"title":"<room title here>","autoAccept":<true or false it didnt matter>
          }'

The actual exploit wasn't creating voice rooms the exploit is that creating an account using roblox usernames didn't require verification until withdrawl so by scraping roblox users then sending them to the "bloxflip.com/api/fusion/roblox-auth" api it would create an account and return the token

So hexxa made a script to spam create accounts and I helped work on it (I added the affliates)

Then after running we would have more then enough accounts to spam voice rooms (and affliates lol) as seen here.

After creating the accounts seen in chapter 4 we would then send a request to the "https://bloxflip.com/api/user/complete-registration" api with the headers and auth token:

curl 'https://bloxflip.com/api/user/complete-registration' \
            -X POST \
            -H 'Content-Type: application/json' \
            -H 'Cookie: app.at=<auth token here>' \
            --data-raw '{
            "affiliateCode": "<affiliate code here>",
            "username": ""
          }'