Hacking the World Poker Tour: Inside ClubWPT Gold's Back Office

#1

Post by notmine1337 » Sun, Oct 26, 2025, 11:48 AM UTC

Hacking the World Poker Tour: Inside ClubWPT Gold's Back Office
samcurry.net

Re: Hacking the World Poker Tour: Inside ClubWPT Gold's Back Office

#2

Post by xraystyle » Wed, Oct 29, 2025, 6:55 PM UTC

What's this 'subs' command being run to enumerate subdomains?

Re: Hacking the World Poker Tour: Inside ClubWPT Gold's Back Office

#3

Post by gs17 » Wed, Oct 29, 2025, 7:33 PM UTC

xraystyle wrote: post #2

What's this 'subs' command being run to enumerate subdomains?

I suspect it's a bespoke script. The first use outputs "[domain] -> [ip]", the second use outputs "[domain] [http code] [?] [size?] [title] [info]".

Re: Hacking the World Poker Tour: Inside ClubWPT Gold's Back Office

#4

Post by perrysmith » Wed, Oct 29, 2025, 8:00 PM UTC

xraystyle wrote: post #2

What's this 'subs' command being run to enumerate subdomains?

I was wondering the same thing. Ran to my Kali instance and tried it out lol

Re: Hacking the World Poker Tour: Inside ClubWPT Gold's Back Office

#5

Post by bauruine » Wed, Oct 29, 2025, 8:06 PM UTC

xraystyle wrote: post #2

What's this 'subs' command being run to enumerate subdomains?

Not sure what it is but certificate transparency logs are a goldmine for this.

https://crt.sh/?q=liuxinyi1.cn

Re: Hacking the World Poker Tour: Inside ClubWPT Gold's Back Office

#6

Post by xraystyle » Wed, Oct 29, 2025, 8:28 PM UTC

perrysmith wrote: post #4

xraystyle wrote: post #2

What's this 'subs' command being run to enumerate subdomains?

I was wondering the same thing. Ran to my Kali instance and tried it out lol

So is it a thing in security distros? Is there a github for it?

Re: Hacking the World Poker Tour: Inside ClubWPT Gold's Back Office

#7

Post by zenmac » Wed, Oct 29, 2025, 8:31 PM UTC

bauruine wrote: post #5

xraystyle wrote: post #2

What's this 'subs' command being run to enumerate subdomains?

Not sure what it is but certificate transparency logs are a goldmine for this. https://crt.sh/?q=liuxinyi1.cn

Oh got this"

"CONTEXT: PL/pgSQL function web_apis(text,text[],text[]) line 4671 at FOR over EXECUTE statement ERROR: server conn crashed?"

May be pushing a bit too hard on their postgres-rest ?

Re: Hacking the World Poker Tour: Inside ClubWPT Gold's Back Office

#8

Post by xraystyle » Wed, Oct 29, 2025, 9:47 PM UTC

bauruine wrote: post #5

xraystyle wrote: post #2

What's this 'subs' command being run to enumerate subdomains?

Not sure what it is but certificate transparency logs are a goldmine for this. https://crt.sh/?q=liuxinyi1.cn

That's interesting. Suppose it doesn't do you any good if you're looking for subdomains that don't have certs though.

Re: Hacking the World Poker Tour: Inside ClubWPT Gold's Back Office

#9

Post by uncivilized » Thu, Oct 30, 2025, 1:03 AM UTC

This was a really great read. Thanks for sharing.

Re: Hacking the World Poker Tour: Inside ClubWPT Gold's Back Office

#10

Post by greatgib » Thu, Oct 30, 2025, 2:00 AM UTC

And the biggest question that all of that raises and stays unaddressed is how a US official and regulated gambling website is developped and probably operated directly from China?

Meaning all PII (name, address , id scans, ip, ...) are available to Chinese individuals.

The argument that the dev website is just developped in China doesn't hold as you can see that the prod admin panel is also partially in Chinese.

And what to say about the admin that is really using 123456 as password in production...