Hacking --- Was it Myntra !!! ?? Yes !

Hi,



Some of you following me on Twitter already had some smell of the stuff and hack!

We wanted to have few T-shirts for MyKavita.com (which is India's leading Poetry website) and Mobile 4 Mumbai (which is first ever city bus search on mobile still in private beta).

Somehow we found that Myntra is leading provider of personalized stuffs like T-shirt, Keychain, Mug etc and we put the order for few T-shirts !


As always, i was in hacky mind and found that Myntra is open system ! Anyone (even non-authorized) user can get some of the very imp and personal information of Myntra's users like Mobile Number, E-mail, Postal Address, Order amount etc !

Additional to that it was fun (although accidently !) to place the order and get invoice without paying any money :)


Here is few sample screenshots which clearly shows your personal information [your name, id, cell no, phone number, E-mail, Postal Address, Order amount and details etc]











We have reported the issue to Myntra on 21st Dec, Sunday around 5:30 IST.

Myntra's team had called me, got explaination and confirmed the security/Privacy loophole within next 4 hr of reporting.

While publishing this post, Ashutosh from Myntra has taken active roll in managing the fix.

Overall impression:
Still its my first shopping experience, they are quick to revert and slow to act upon. After reporting the issues we do have around 3-4 phone calls etc.

Hope, they deliver the stuff on time [even i had not make payment till. :) ]








Disclaimar :

Offer of free T-shirt for not posting this post is rejected :)

Myntra is knowing that we had not make payment, we asked them we will pay full amount as soon as they provide the account details.

Do not worry for creditcard/netbanking information, it was not accessible !

Suggestion to Myntra to have strict auditing of their system




Update 1 :

-------

me: have look at,

http://raxitsheth.blogspot.com/2008/12/hacking.html

just published !

lawania: ok

me: just check if any issue, let me know. will try to correct it.

lawania: see if you can remove the payment thing..as I called you up and asked that you payment is not approved..

me: Hmm. but then how would i get invoice ?

lawania: seems to be unusual cas .. sofar not got such issue..

but we did not get any confirmation mail for payment..

lawania: Since I was there in office on Sunday and I noticed the issue and immdiately called you

me: hmm. i am puting this chat as update ? is it fine ?

it will clearify to reader.

--------
Update 2:

Ashutosh from Myntra has called me on 26 Dec around 12:00 am [Or 25 dec around 11:55 pm]. He explained me that normally it is not offered in bribing sense, but it is in customer friendly sense. Whatsoever it is he is feeling shame and sorry for the same stuff.

below is the part of E-mai reply,

"We at Myntra are committed for best user experience. We are very serious about for customer data security.We will have complete security audit of our website and fix if there is any loop hole."
--------


Do you know any other hack ? ping me privately to raxit@m4mum.com !



Happy Hacking :)


Raxit Sheth
www.mykavita.com
www.m4mum.com

Poetry Meet

Hey


I was attending Poetry Meet, Dec 20th 2008 @ Oxford Book Store ! Overall it was a small but nice and interesting meet !


It was nice to meet poet, especially folks like Renu Rakheja, Preeti Datar.

The one interesting part is one folks shown up, who was @ Taj. He is journalist, namely Bhisham Mansukhani. He had a very interesting thought. The real experience and feeling is very much different,when he had seen terror ! Felt "near death" experience. Very much Agree Sir !

You may would like to read log of his SMS during the "Terror @ Taj Night !" here

Additional to that, there was reading of few intersting poem by Parikshit, Rajshree and other member [sorry could not remember all d name :( ]


There was two queries i am being asked, hey it was not who is kavita ? ;)

1. What languages are supported by MyKavita.com ?

Mykavita we are supporting all the languages, typing support for almost all indic languages are there including Hindi,English,Telugu,Malyalam,Panjabi, Gujarathi, Urdu !. Indeed MyKavita team was few of the early folks which hs involved closely with Wordpress Core team for the plugin development for Indian languages support !. More than that You can have blogs like www.YourName.MyKavita.com

2. Is this my First poetry Meet ?
Yes. Many of you must be knowing i do have some other schedule on Second Saturday ! This was 3rd and fortunately i had just shown up !


I would say it is really interesting to meet Face to Face, it was enriching and good experience. Keep it up your p4poetry i.e. Passion 4 Poetry !


Stay tuned to here more,


-Raxit Sheth
Co-Founder www.Mykavita.com

Pattern Matching -- Mumbai Bus Stop

Hey



I just finished some initial Hacky Code of Pattern Matching. You may find it useful.,........ Please put your Comment or E-mail me your thoughts !!! How it can be useful ?

On Web ?
On Mobile ?
As Web Service ?

Any other thoughts ???




Its return in Java ! :) :) :) Oh Yeah. Don't get Shocked its Java !


I asked couple of Folks, they told very much good result....

Thanks to Dinesh Soni, Aditi Gupta and Anjali

Below is sample conversation with few folks who got a chance to Try it !!! [thru google chat ! :) ]


mykavita$ java Main

Its Re-Usable and well Re-factored code, In Below High Rank means more matching and low rank is less matching !



-----------Below is chat message ------------

1. Dinesh Soni [this guy always ping me First !!!]

me: prepared a pattern matching program. where you provide few letter of bus stop... It will predict Best Match !!! Working fine so far, but still Experimental !!! Shortly will put it on Web !!!!
Sent at 11:19 PM on Wednesday
Dinesh: cool
Sent at 11:21 PM on Wednesday
me: just tell me 3-4 lettter of any bus stop, My prog will try to predict
Sent at 11:24 PM on Wednesday
Dinesh: chet
me: just tell me 3-4 lettter of any bus stop, My prog will try to predict

cheetacamp:::Rank=20
chakalacigarettefactory:::Rank=17
chakalamarket(up):::Rank=17
chemburstn./dr.ambedkargarden:::Rank=17
chemburstn.roadno1:::Rank=17
kherwadi/chetnacollege:::Rank=16
checknaka(dahisar):::Rank=15
checknaka(ferrywharf):::Rank=15
chemburlevelcrossing/shellbridg:::Rank=15
chemburnaka/swamivivekanandchk:::Rank=15
c&dshed(cottongreen-e):::Rank=14
centraldairy:::Rank=14
centrallabourinstitute(sion):::Rank=14
centralrlygoodsmazgaon:::Rank=14
centraltalkies(up):::Rank=14
chhedanagar:::Rank=14
khetwadi:::Rank=14
sacredheartschool(khar):::Rank=14
High rank means more matching
Was this expected ?
Top Entries are most matched !!!
Sent at 11:28 PM on Wednesday
Dinesh: cool man
:)
Sent at 11:31 PM on Wednesday
me: just finished b4 10 min ! Shortly i will put it on Web !!!
after 10-15 days !! :)
Dinesh: :)
will be waiting
me: :)
Sent at 11:33 PM on Wednesday
me: May i put your name and Result in Blog ??? I am just blogging about it !!!
Dinesh: sure yar
of course u can
Sent at 11:35 PM on Wednesday

------------------------


2. Aditi Gupta

me: give me 3-4 letter of your favourite Bus Stop. My Program will try to Predict the Stop !!!

Its AI Program. Shortly i will put on web !

Aditi: dada

chem

band

me: High rank means more matching

Aditi: and

hmm

me: samurai@raxit-laptop:~/Desktop/Saad/Raxit/backup/NetBeansProjects/PredictStop/src/predictstop$ java Main dada
Raxit Start---
dada
Dummy:::Rank=100
dadarstation-w(s.bapatroad):::Rank=21
damodarhall:::Rank=19
dandpada(khardanda):::Rank=19
dayaldasrd/gujaratsociety(parle):::Rank=18
khodadadcircle:::Rank=18
khodadadcircle(bhavechk)(up):::Rank=18
khodadadcircle(l.t.road):::Rank=18
adarshdairy-chunilalgirdharlalrd:::Rank=17
dadojikondevnagar(chembur-e):::Rank=17
dattapada(magathane):::Rank=17
dattapadamun.school(magathane)(up):::Rank=17
daulatnagar(dahisar-e):::Rank=17
devipada(borivli(e)):::Rank=17
dindoshipada:::Rank=17
gadiadda(reayroad-e):::Rank=17
adarshnagar-(appapadamalad-e):::Rank=16
azadmaidan(m.gandhiroad):::Rank=16
bhavanscollege(dadabhaird-andh(up):::Rank=16
Raxit End-------------
samurai@raxit-laptop:~/Desktop/Saad/Raxit/backup/NetB

samurai@raxit-laptop:~/Desktop/Saad/Raxit/backup/NetBeansProjects/PredictStop/src/predictstop$ java Main chem
Raxit Start---
chem
Dummy:::Rank=100
chemburlevelcrossing/shellbridg:::Rank=21
chemburnaka/swamivivekanandchk:::Rank=21
chemburstn./dr.ambedkargarden:::Rank=21
chemburstn.roadno1:::Rank=21
calicomills(chembur):::Rank=17
cheetacamp:::Rank=17
chitracinema(dadar):::Rank=17
chitracinema(dn):::Rank=17
polychemco.(b.d.patilrd-mahul:::Rank=17
azizbaug(chembur):::Rank=16
basantpark/sukhinivas(chembur):::Rank=16
basanttalkies(chembur):::Rank=16
bhaktibhavan(chembur):::Rank=16
bharatpetroleum(chembur):::Rank=16
bhikajidamajipatilmarg(chembur):::Rank=16
dadojikondevnagar(chembur-e):::Rank=16
dr.ambedkargarden(chembur):::Rank=16
fineartsauditorium(chembur):::Rank=16
Raxit End-------------
samurai@raxit-laptop:~/Desktop/Saad/Raxit/backup/Ne

samurai@raxit-laptop:~/Desktop/Saad/Raxit/backup/NetBeansProjects/PredictStop/src/predictstop$ java Main band
Raxit Start---
band
Dummy:::Rank=100
bandongri:::Rank=21
bandrabusstation(w):::Rank=21
bandracolonybusstn:::Rank=21
bandrakurlacomplex:::Rank=21
bandrareclamationbusstn:::Rank=21
bandrarlycrossing(e):::Rank=21
bandrarlyterminal:::Rank=21
bandrastation(e):::Rank=21
bandratalao(gurunanakroad):::Rank=21
bandratalkies(gurunanakroad):::Rank=21
bandratalkies(s.v.road):::Rank=21
bandratalkies(v.patelroad):::Rank=21
bandrekarwadi(jogeshwaripol.stn:::Rank=21
bandstand(babulnath):::Rank=21
bhandupcomplex:::Rank=20
bhanduppeoplesschool(bhandup-w:::Rank=20
bhanduppumpingcentre(v.naikrd:::Rank=20
bhandupstation(a.p.i.):::Rank=20
Raxit End-------------

Is this Good Result ???? Expected ?

Aditi: why are u sending me all this

me: just to actually compare the result !! Please copy paste in notepad. it ill just take 1 min.... !!!

This program is i am running locally... but soon will be online !!!

Aditi: hmm ok

the results are good

me: Tnx.

just finished coding b4 10 min. Still i think once put on Web, it can learn by itself and improve the result !

And we can have more data set !!!

Aditi: hmm

me: Tnx for trying.

May i put your name and Result in Blog ??? I am just blogging about it !!!

Aditi: go ahead

Sent at 11:35 PM on Wednesday

--------------------


3. Anjali [Note : Not Anjali Rego ]

me: just tell me 3-4 lettter of any bus stop, My prog will try to predict
anjali: 309
me: Bus Stop !!!
anjali: Mahindra
saidham
me: Raxit Start---
MahindraRaxit Start---
Mahindra
Dummy:::Rank=100
mahindraco.gate(bhadcolony):::Rank=41
mgandhividyamandirbandracolony:::Rank=32
mahavirnagar(dahanukarwadi):::Rank=29
mahavirnagarext.(dahanukarwadi):::Rank=29
amarnagar(khindipada):::Rank=28
gandhinagar(bandracolony):::Rank=28
durgamaheshwarimandir(charkop):::Rank=26
jarimaritemple(bandra)(up):::Rank=26
maheshwarinagar(marol):::Rank=26
maroshinaka/picnicpoint:::Rank=26
amarmahal(p.l.lokhanderoad):::Rank=25
machhimarnagar(mahim):::Rank=25
madhurcolony(chincholibunderrd):::Rank=25
municipalcolony(khindipada):::Rank=25
maharanapratapchk(mazgaon):::Rank=24
mandpeshwarindst.(borivli-w):::Rank=24
marathividnyanparishad(a.t.i):::Rank=24
kalamarutimandir(kandivli-w):::Rank=23
Raxit End-------------
samurai@raxit-laptop:~/Desktop/Saad/Raxit/backup
Dummy:::Rank=100
mahindraco.gate(bhadcolony):::Rank=41
mgandhividyamandirbandracolony:::Rank=32
mahavirnagar(dahanukarwadi):::Rank=29
mahavirnagarext.(dahanukarwadi):::Rank=29
amarnagar(khindipada):::Rank=28
gandhinagar(bandracolony):::Rank=28
durgamaheshwarimandir(charkop):::Rank=26
jarimaritemple(bandra)(up):::Rank=26
maheshwarinagar(marol):::Rank=26
maroshinaka/picnicpoint:::Rank=26
amarmahal(p.l.lokhanderoad):::Rank=25
machhimarnagar(mahim):::Rank=25
madhurcolony(chincholibunderrd):::Rank=25
municipalcolony(khindipada):::Rank=25
maharanapratapchk(mazgaon):::Rank=24
mandpeshwarindst.(borivli-w):::Rank=24
marathividnyanparishad(a.t.i):::Rank=24
kalamarutimandir(kandivli-w):::Rank=23
Raxit End-------------
samurai@raxit-laptop:~/Desktop/Saad/Raxit/backup
anjali: pushpa park
me: just tell me 3-4 lettter of any bus stop, My prog will try to predict
Just 3-4 on mobile none wants to enter saidham ! just sai is enough
High rank means more matching
me: May i put your name and Result in Blog ??? I am just blogging about it !!!
anjali: what are u writing? its about what? what do u want to do?
me: its about this program and the result !
anjali: ok
i dont have any prob until and unless its go to wrong hand
are u still doing coding?
@ home too?
me: no now i am blogging :)
anjali: get some rest yr mind
me: I am at home only !!!!
anjali: anyways

----------------


Who know Mobile 4 Mumbai may be powered by this ? :)



Thanks to havocke for giving back my data :)






-Raxit Sheth
www.MyKavita.com

Security , Cleartext password and more --- india's leading matrimonial website !

Hi All,

To all readers who may think this is speech related blogpost, please regret !

Again i cant stop writing this post, and I come to know like this way !

I just came from office and was doing some stuff around www.mykavita.com And some regular E-mail check, learning J2ME, little bit python... Enough Computer.... Let me search my life partner !

So i logged in to india's one of the famous matrimonial portal, browse few profile, and do some search ! After some time, i think Let me see this Chat feature...i just click "ChatOnline" button !

rest is self explanatoin by below screenshot !!!




Note : if you are simple, caring, good looking, gujju girl [Age 21-24] you may want to drop me a line ! seriously :)

Please note : dont try to login with above username and password... it is just for example :)


I was thinking should i post before they fix or should i post right now ? I have just try to make call on the number provided, and send an E-mail.

After some thought, i conclude it is not a BUG, it is NOT unknown to them, What is your thought ?

Do you want person standing/seating near to you shold view your password ? Comment is open !

Update :
login to jeevansathi.com and then try to open ChatNow. One chat windows will open, try to enter the userid and password !


Cheers,
Raxit

openpls, mykavita , mobile 4 mumbai and other updates !

What we are upto !

Few readers ping us not much "On-Topic" blogpost related to Voip/VoiceXml/IVR etc ???

Let me explain a bit

MyKavita
Some of you already knowing, in January we launched http://www.Mykavita.com [Kavita means poem] a website based on wordpress where people can write their poem. This was interesting idea on my mind. Its going better than expected !. Our host asked to increase RAM/cpu for the server !. There are some more plan ahead, and some competitor also of the site ! Yeah !

If you are interested in update of mkavita,progress of it, and more details, please refer Mykavita blog http://www.mykavita.com/blog

Mobile 4 Mumbai
Additional to that, some of indian friends, barcampers and MoMo people knowing about the project just kickstarted ! Mobile 4 Mumbai http://m4mum.com ! Its basically some useful utility that can help normal people (this application is having indian context)

OpenPLS
Last but not least is, OpenPLS, www.sourceforge.net/projects/openpls
PLS is related to Speech Technology ! Its Java (Yeah dont panic !) based opensource implementation (LGPL License) we are developing. You must be guessing you have read somewhere on www-voice@w3.org , Yes you are correct Dirk www.jvoicexml.org has announced the project.


For openpls we are into requirenment gathering stage for implementation. if you are geek who want to design and code from scratch, drop a note to me or dirk ! You can be part of openpls.


Let me know for any query !

Note :
Mobile 4 mumbai, if you are into mobile gui development (j2me, symbian, nokia any platform any language, and if you think the project is useful and you want to involved. drop a line to me.)

OpenPLS: Contributors/volunteers contact dirk or me.



Cheers,
Raxit