Webtresting

There is a loophole in the RapidShare Premium account system. If you exploit this loophole you can create RapidShare extra premium accounts. Lets see how:

RapidShare Premium account system:

1. When a Premium user downloads your file, of file size greater than 3mb, you get Rapidpoints.
2. At the end of the day you can accumulate a maximum of 255 points.
3. You need 10000 points to get a new premium account.
4. There is a remote upload feature in RapidShare, using which one can upload files from anywhere on the internet to his/her RapidShare Account.

How the system can be exploited:

Here is the narration of someone who exploited the system to get a new Rapidshare premium account.

A few days ago I got four phished accounts from an online community. Now there is this Rapidpoint Premium user points. Premium users point which you get when a premium user downloads your file which is greater then 3 mb size. At the end of the day one can accumulate a maximum of 255 points. That means if the total count of files downloads per day is 255 you can get a new premium account in just 40 days.

Now the account which I got has already 8000 points so I just needed 2000 point to make a new account . Now I noticed that we get rapidpoints for downloading from our own premium account. But it is not feasible as downloading a 3 mb file 255 times a day is just insane. But there is this remote upload feature of Rapid Share. So if we can transfer files from one RapidShare account to another RapidShare account, we still get points. But remote uploading from RS<->RS is not possible as they have restricted it.

I just used the my account and password to make premium url, and then used tinyurl to mask it and RapidShare was not able to distinguish it. It downloaded all the file from one of my account to another, and in the process added 50 hefty points to my premium acc. I repeated this process 5-6 times a day and I got 255 points at the end of the day. If I go with same speed in one week I will make a new account from my premium account. Therefore moral of the story is RS programmers didn’t paid heed to preium acc loopholes. Then only secured free user zone.