Gaia "chap" code?

[Stapled]

Gaia updated the user stores and now to sell/cancel an item you need the nonce+chap. Everything seemed fine until I found that this is the only part of the site that uses it and it shows up as nothing in the page source. Does any one know of a way to find it?

[Shell]

grab it like the nonce, its in the login aswell you dont need it.

[Stapled]

grab it like the nonce, its in the login aswell you dont need it.

I tried but unlike the nonce it shows up as: <input type="hidden" name="chap" value="" />

Nothing in the quotes.

[Chad]

Just grab it with the wrappers anyway and see what you come back with.

[~Shieru No Tamashi~]

Since the login is still working without posting any chap code, then I guess the sell/cancel would work the same way.

EDIT: I just tried and it seems not trk. That chap string seems to be something random.

[Stapled]

I'm pretty sure it's something encrypted in MD5 32 char.

[Chad]

Most likely it's PHP Generated. Try something along the lines of, md5(md5(randomly generated string here) + "Go-Gaia-XD-72squared")
Not sure if they are using another salt.

[Stapled]

Most likely it's PHP Generated. Try something along the lines of, md5(md5(randomly generated string here) + "Go-Gaia-XD-72squared")
Not sure if they are using another salt.

But what is the random string? I've tried the nonce alone, password+nonce and nonce+password.

[Chad]

But what is the random string? I've tried the nonce alone, password+nonce and nonce+password.

A randomly generated string that you create with a function. You could probably use Nonce as the random string.

[Stapled]

A randomly generated string that you create with a function. You could probably use Nonce as the random string.

It doesn't work :/

I tried it with bot selling and canceling.

EDIT: It's

MD5(MD5(Gaia_Pass) + NONCE)

[Artificial]

When it's blank like that you can be guaranteed it's eventually handled/populated by JS. Just look in the JS files on the page and you'll have your answer.