0nyxx
New member
- Jul 15, 2020
- 10
- 2
- 3
I am new into pentesting, lets be friends 
Hi Guys,
This is Zer0. I generally belong to the Dark web but recently a friend of mine referred me to the "Hottest thread" of this forum which also became "Most Viewed" thread of all time.
Yes, I'm talking about "BubbleTok" (the so called Tik Tok Clone by it's author). Before I get into the detailings, I wanna tell, I'm an active user on Codecanyon too and I recently discovered this app named "BubbleTok". The app is priced at $1004 for a regular license and a freaking 50K USD for an extended one. And there is a lot of hype about this app on the web as well as codecanyon.
At first, I downloaded all the available resources related to it from this forum and tried to run. And soon I realized, it was broken. After reviewing almost 300 comments on this forum and 250ish comments on codecanyon, I decided to do a research about it.
And here it is :
1. I hacked their server.
There are around 4 to 5 more scripts running on the same server. None of them is a quality based product.
2. Hacked it's cPanel.
There are 13 subdomains running on it. Earlier they had Vilo on the same server and they recently shifted to another one after knowing they were hacked.
3. Dumped all their databases.
I've dumped all their database. Not only the one those are linked to scripts. I've downloaded more
There is a very famous app on play store which uses the same "BubbleTok" script. I'm going to reveal more about them in a day or two.
4. Your admin panel looks different than mine.
Since you guys just have the initial version and I've downloaded more of it. My admin panel is better than yours.
5. Look at their Phpmyadmin.
There is a subdomain "vilo.invatomarket.com" which was hosted on the same server as I've mentioned in point 2. Now, Look at the screenshot I've attached below. The database is almost empty. It doesn't have admin records. Now the same subdomain is attached to a different hosting and database.
PS : The attached file "invato domains.txt" has all the list of domains associated with the developer/author.
Conclusion : I've seen people ready to buy this script in collaboration with others. DON'T DO THAT. This guy is a fraud. Also, if you need any of their script that's available on Digicean.com, do let me know. I'll send it to you.