October 2012 - skunkworks - Skunkworks Site

Wacom pad
by Mark Mwangi 13 Oct '12

13 Oct '12

Anyone have this for sale?

1 0

Fwd: [Security Forum] HACKBATTLE 2012 OFFICIALLY STARTS (Engage TheBlackhat)
by Gichuki John Chuksjonia 12 Oct '12

12 Oct '12

---------- Forwarded message ---------- From: Gichuki John Chuksjonia <chuksjonia(a)gmail.com> Date: Fri, 12 Oct 2012 18:55:47 +0300 Subject: Re: [Security Forum] HACKBATTLE 2012 OFFICIALLY STARTS (Engage TheBlackhat) To: "Security Forum All information security discussions in Africa are done here (Hacking, Decryptions, Security management, physical security, Disastor Recovery, Security Assessments etc etc)" <security(a)lists.my.co.ke> Update on the scenerios for the Hackbattle2012 rerun, http://chuksjonia.blogspot.com/2012/10/hackbattle2012-rerun.html On 10/12/12, Gichuki John Chuksjonia <chuksjonia(a)gmail.com> wrote: > Alright Alright, lets be at CIO morrow from 3pm to 4pm, lets keep time > #Hackbattle2012. Am hoping the rerun is going okay for each team. > > On 10/10/12, Gichuki John Chuksjonia <chuksjonia(a)gmail.com> wrote: >> All teams on Hackbattle2012 are invited, please, Teams leaders confirm. >> >> On 10/10/12, Peter Mwangi <mngugi7(a)gmail.com> wrote: >>> I would love to attend Chucks and catchup with the proceedings , please >>> list my name . >>> Kind regards >>> >>> On Tue, Oct 9, 2012 at 9:46 AM, fredrick Wahome <frewah85(a)gmail.com> >>> wrote: >>> >>>> Ok...Good..Confirmed >>>> >>>> >>>> On Tue, Oct 9, 2012 at 4:54 PM, Gichuki John Chuksjonia < >>>> chuksjonia(a)gmail.com> wrote: >>>> >>>>> Teams, CIO magazine will host a meetup October 13th on Saturday >>>>> afternoon, discussions on how the last engagement was achieved also >>>>> brainstorming on the current HB rerun. teams that will be available >>>>> kindly confirm. >>>>> >>>>> Meeting Point is at Muthaiga, CIO Offices, Limuru Road, opp White >>>>> House, Croze 605, you will see it as you come from Muthaiga >>>>> Mini-Market, then get all the way to the Orange gate. If you can't >>>>> find it, search for CIO East Africa on Google-maps. >>>>> >>>>> Lemmie know if you will be available. >>>>> >>>>> >>>>> ./Chucks >>>>> >>>>> On 10/9/12, Samuel Mwai <samuelmwai(a)gmail.com> wrote: >>>>> > cool...we r definitley on >>>>> > >>>>> > On Tue, Oct 9, 2012 at 1:21 PM, Gichuki John Chuksjonia < >>>>> > chuksjonia(a)gmail.com> wrote: >>>>> > >>>>> >> All teams. all servers are ready. rematch goes on until October >>>>> >> 20th. >>>>> >> >>>>> >> Each server has 5 Vulnerabilities, and i have set everything to >>>>> >> simpler state for a better exercise to learn from each other. >>>>> >> >>>>> >> We will rerun Engage the Blackhat next year, on Hackbattle2013. >>>>> >> >>>>> >> On 10/9/12, Gichuki John Chuksjonia <chuksjonia(a)gmail.com> wrote: >>>>> >> > Thank you all. >>>>> >> > >>>>> >> > Been renewing the servers so that we can have a rematch as soon >>>>> >> > as >>>>> >> > possible. For those teams who atleast accessed the servers from >>>>> >> > the >>>>> >> > previous engagement, please send me your names, so that we can >>>>> prepare >>>>> >> > your Tshirts, Teams #OwnerZ and Team #Takerz. Congrats for a job >>>>> >> > well >>>>> >> > done. >>>>> >> > >>>>> >> > Kindly also prepare documentation on how you broke into the Web >>>>> >> > App >>>>> >> > vulnerabilities, hoping you have snapshots too, so that we can >>>>> >> > post >>>>> >> > for everyone to see and learn from you. >>>>> >> > >>>>> >> > #Hackbattle2012 rematch should start today in a few hours. >>>>> >> > >>>>> >> > >>>>> >> > Regards, >>>>> >> > >>>>> >> > ./Chucks >>>>> >> > >>>>> >> > On 10/9/12, Victor Akidiva <akidiva(a)gmail.com> wrote: >>>>> >> >> I second the motion......*applause* >>>>> >> >> >>>>> >> >> Kudos to chucks and all the participants who made it possible. >>>>> >> >> >>>>> >> >> AK. >>>>> >> >> >>>>> >> >> On Tue, Oct 9, 2012 at 10:09 AM, kipropest >>>>> >> >> <kipropbrian(a)gmail.com> >>>>> >> wrote: >>>>> >> >> >>>>> >> >>> *applause* >>>>> >> >>> >>>>> >> >>> >>>>> >> >>> On Mon, Oct 8, 2012 at 11:19 AM, Gichuki John Chuksjonia < >>>>> >> >>> chuksjonia(a)gmail.com> wrote: >>>>> >> >>> >>>>> >> >>>> So far so good. >>>>> >> >>>> >>>>> >> >>>> All teams were able to find vulnerabilities in both >>>>> >> >>>> webservers, >>>>> one >>>>> >> >>>> running joomla and the other drupal / ViArt Shop Enterprise >>>>> >> >>>> and >>>>> they >>>>> >> >>>> were able to load up webshells. >>>>> >> >>>> >>>>> >> >>>> So after webshells were loaded, they recognized users on >>>>> /etc/passwd >>>>> >> >>>> and decided to log in using these usernames. >>>>> >> >>>> >>>>> >> >>>> First mistakes each team did was to look for a short cut to >>>>> >> >>>> hack >>>>> >> >>>> into >>>>> >> >>>> these servers via kernels exploitation, i knew that would >>>>> >> >>>> happen. >>>>> No >>>>> >> >>>> one took time to read /etc/passwd to think about why not we >>>>> >> >>>> even >>>>> try >>>>> >> >>>> the second user. Both these users had simple passwords, eg >>>>> >> >>>> cpanel >>>>> >> >>>> was >>>>> >> >>>> 'cpanel123' and shiro had 'goodafternoon' which was a password >>>>> used >>>>> >> >>>> in >>>>> >> >>>> mysql, found on config file for the web app. >>>>> >> >>>> >>>>> >> >>>> If these teams looked clearly, they would have checked Desktop >>>>> >> >>>> directory home directory of each server. >>>>> >> >>>> >>>>> >> >>>> With this info picked up, if anyone looked into these home >>>>> directory >>>>> >> >>>> as below, they would have found the shadow file as below, >>>>> >> >>>> >>>>> >> >>>> tcpdump **Never logged in** >>>>> >> >>>> webmaster pts/0 212.22.185.130 Fri Oct 5 10:32:52 >>>>> +0100 >>>>> >> >>>> 2012 >>>>> >> >>>> cpanel pts/3 server109-xxx.xxx. Mon Oct 8 >>>>> >> >>>> 08:32:46 >>>>> >> >>>> +0100 >>>>> >> >>>> 2012 >>>>> >> >>>> memcached **Never logged in** >>>>> >> >>>> [cpanel(a)server109-xxx.-xxx-xxx ~]$ ls >>>>> >> >>>> Maildir shadow >>>>> >> >>>> >>>>> >> >>>> >>>>> >> >>>> and on the other box, the home directory had a mail folder, >>>>> >> >>>> and >>>>> they >>>>> >> >>>> could have gone ahead and found a mail as below >>>>> >> >>>> >>>>> >> >>>> tcpdump:x:72:72::/:/sbin/nologin >>>>> >> >>>> suzie:x:500:500:suzie,suzie,373637,37363873:/home/suzie:/bin/bash >>>>> >> >>>> shiro:x:501:501::/home/shiro:/bin/bash >>>>> >> >>>> [root@server109-xxx-xxx-xxx ~]# cd /home/shiro/ >>>>> >> >>>> [root@server109-xxx-xxx-xxx shiro]# ls >>>>> >> >>>> Maildir >>>>> >> >>>> [root@server109-xxx-xxx-xxx shiro]# cd Maildir/ >>>>> >> >>>> [root@server109- Maildir]# ls >>>>> >> >>>> cur new >>>>> >> >>>> [root@server109-xxx-xxx-xxx Maildir]# cd cur/ >>>>> >> >>>> [root@server109-xxx-xxx-xxx cur]# ls >>>>> >> >>>> mail1 >>>>> >> >>>> [root@server109-xxx-xxx-xxx cur]# cat mail1 >>>>> >> >>>> 15th September 2012 mail1 password is mrfreakshow2012 >>>>> >> >>>> >>>>> >> >>>> >>>>> >> >>>> 3rd October 2012 The black hat team gained this access, thank >>>>> >> >>>> you >>>>> >> >>>> for >>>>> >> >>>> your coperation, #Blackdiamond #hackbattle2012 >>>>> >> >>>> >>>>> >> >>>> So right now am reseting the servers, the BH team has >>>>> >> >>>> forwarded >>>>> all >>>>> >> >>>> credentials and am hoping we should be back to the whole game >>>>> again >>>>> >> >>>> by >>>>> >> >>>> evening. >>>>> >> >>>> >>>>> >> >>>> Good luck to all. >>>>> >> >>>> >>>>> >> >>>> >>>>> >> >>>> >>>>> >> >>>> >>>>> >> >>>> >>>>> >> >>>> On 10/4/12, Gichuki John Chuksjonia <chuksjonia(a)gmail.com> >>>>> >> >>>> wrote: >>>>> >> >>>> > So am speaking with a Head of Security in one of the biggest >>>>> banks >>>>> >> >>>> > about #Hackbattle2012 and after i showed her how to gain >>>>> >> >>>> > root, >>>>> she >>>>> >> >>>> > says, who ever gets the SU by Friday night, Taken2 tickets >>>>> >> >>>> > are >>>>> his >>>>> >> >>>> > and >>>>> >> >>>> > the team, for Saturday Show in Westgate. Good luck ya'all. >>>>> >> >>>> > >>>>> >> >>>> > On 10/2/12, Gichuki John Chuksjonia <chuksjonia(a)gmail.com> >>>>> wrote: >>>>> >> >>>> >> Okay, a team has gained access to one of the servers, >>>>> >> >>>> >> update >>>>> soon >>>>> >> on >>>>> >> >>>> >> twitter. >>>>> >> >>>> >> >>>>> >> >>>> >> On 10/2/12, Justin Mosbey <mosbeyj(a)gmail.com> wrote: >>>>> >> >>>> >>> Deepest Condolence Peter. >>>>> >> >>>> >>> >>>>> >> >>>> >>> Best wishes to all teams, while you are at it >>>>> >> >>>> >>> #HACKBATTLE2012 >>>>> >> >>>> >>> make >>>>> >> >>>> sure >>>>> >> >>>> >>> you >>>>> >> >>>> >>> find some time and watch the movie/documentary "We Are >>>>> >> >>>> >>> Legion >>>>> >> >>>> >>> 2012"- >>>>> >> >>>> The >>>>> >> >>>> >>> story of the Hacktivists. >>>>> >> >>>> >>> >>>>> >> >>>> >>> Regards, >>>>> >> >>>> >>> Justin >>>>> >> >>>> >>> >>>>> >> >>>> >> >>>>> >> >>>> >> >>>>> >> >>>> >> -- >>>>> >> >>>> >> -- >>>>> >> >>>> >> Gichuki John Ndirangu, C.E.H , C.P.T.P, O.S.C.P >>>>> >> >>>> >> I.T Security Analyst and Penetration Tester >>>>> >> >>>> >> jgichuki at inbox d0t com >>>>> >> >>>> >> >>>>> >> >>>> >> {FORUM}http://lists.my.co.ke/pipermail/security/ >>>>> >> >>>> >> http://chuksjonia.blogspot.com/ >>>>> >> >>>> >> >>>>> >> >>>> > >>>>> >> >>>> > >>>>> >> >>>> > -- >>>>> >> >>>> > -- >>>>> >> >>>> > Gichuki John Ndirangu, C.E.H , C.P.T.P, O.S.C.P >>>>> >> >>>> > I.T Security Analyst and Penetration Tester >>>>> >> >>>> > jgichuki at inbox d0t com >>>>> >> >>>> > >>>>> >> >>>> > {FORUM}http://lists.my.co.ke/pipermail/security/ >>>>> >> >>>> > http://chuksjonia.blogspot.com/ >>>>> >> >>>> > >>>>> >> >>>> >>>>> >> >>>> >>>>> >> >>>> -- >>>>> >> >>>> -- >>>>> >> >>>> Gichuki John Ndirangu, C.E.H , C.P.T.P, O.S.C.P >>>>> >> >>>> I.T Security Analyst and Penetration Tester >>>>> >> >>>> jgichuki at inbox d0t com >>>>> >> >>>> >>>>> >> >>>> {FORUM}http://lists.my.co.ke/pipermail/security/ >>>>> >> >>>> http://chuksjonia.blogspot.com/ >>>>> >> >>>> _______________________________________________ >>>>> >> >>>> Security mailing list >>>>> >> >>>> Security(a)lists.my.co.ke >>>>> >> >>>> http://lists.my.co.ke/cgi-bin/mailman/listinfo/security >>>>> >> >>>> >>>>> >> >>> >>>>> >> >>> >>>>> >> >>> _______________________________________________ >>>>> >> >>> Security mailing list >>>>> >> >>> Security(a)lists.my.co.ke >>>>> >> >>> http://lists.my.co.ke/cgi-bin/mailman/listinfo/security >>>>> >> >>> >>>>> >> >>> >>>>> >> >> >>>>> >> >> >>>>> >> >> -- >>>>> >> >> Know thy enemy and know thyself, and you shall survive the >>>>> >> >> outcome >>>>> of >>>>> >> >> a >>>>> >> >> thousand battles. >>>>> >> >> >>>>> >> > >>>>> >> > >>>>> >> > -- >>>>> >> > -- >>>>> >> > Gichuki John Ndirangu, C.E.H , C.P.T.P, O.S.C.P >>>>> >> > I.T Security Analyst and Penetration Tester >>>>> >> > jgichuki at inbox d0t com >>>>> >> > >>>>> >> > {FORUM}http://lists.my.co.ke/pipermail/security/ >>>>> >> > http://chuksjonia.blogspot.com/ >>>>> >> > >>>>> >> >>>>> >> >>>>> >> -- >>>>> >> -- >>>>> >> Gichuki John Ndirangu, C.E.H , C.P.T.P, O.S.C.P >>>>> >> I.T Security Analyst and Penetration Tester >>>>> >> jgichuki at inbox d0t com >>>>> >> >>>>> >> {FORUM}http://lists.my.co.ke/pipermail/security/ >>>>> >> http://chuksjonia.blogspot.com/ >>>>> >> _______________________________________________ >>>>> >> Security mailing list >>>>> >> Security(a)lists.my.co.ke >>>>> >> http://lists.my.co.ke/cgi-bin/mailman/listinfo/security >>>>> >> >>>>> > >>>>> >>>>> >>>>> -- >>>>> -- >>>>> Gichuki John Ndirangu, C.E.H , C.P.T.P, O.S.C.P >>>>> I.T Security Analyst and Penetration Tester >>>>> jgichuki at inbox d0t com >>>>> >>>>> {FORUM}http://lists.my.co.ke/pipermail/security/ >>>>> http://chuksjonia.blogspot.com/ >>>>> _______________________________________________ >>>>> Security mailing list >>>>> Security(a)lists.my.co.ke >>>>> http://lists.my.co.ke/cgi-bin/mailman/listinfo/security >>>>> >>>> >>>> >>>> >>>> -- >>>> Kind Regards; >>>> >>>> ------------------------------------------ >>>> *Fredrick Wahome Ndung'u >>>> Team Leader >>>> Secunets Technologies >>>> Website: www.secunets.co.ke <http://www.secunets.com> >>>> Cell: +254725264890 >>>> Email: fred(a)secunets.co.ke <fred(a)secunets.com> >>>> Experts in: Web 2.0 Applications, Domain Registration, Web Hosting, >>>> Information Security, Linux Applications, Computer Forensic & I.C.T >>>> Consultancy. >>>> >>>> "Secure Business Technology"* >>>> >>>> >>>> ------------------------------------------------------------------------------- >>>> *SECUNETS TECHNOLOGIES DISCLAIMER:* >>>> >>>> This email message and any file(s) transmitted with it is intended >>>> solely >>>> for the individual or entity to whom it is addressed and may contain >>>> confidential and/or legally privileged information which >>>> confidentiality >>>> and/or privilege is not lost or waived by reason of mistaken >>>> transmission. >>>> If you have received this message by error you are not authorized to >>>> view >>>> disseminate distribute or copy the message without the written consent >>>> of >>>> Secunets Technologies and are requested to contact the sender by >>>> telephone >>>> or e-mail and destroy the original. Although Secunets Technologies >>>> takes >>>> all reasonable precautions to ensure that this message and any file >>>> transmitted with it is virus free, Secunets Technologies accepts no >>>> liability for any damage that may be caused by any virus transmitted by >>>> this email. >>>> >>>> >>>> >>>> _______________________________________________ >>>> Security mailing list >>>> Security(a)lists.my.co.ke >>>> http://lists.my.co.ke/cgi-bin/mailman/listinfo/security >>>> >>>> >>> >> >> >> -- >> -- >> Gichuki John Ndirangu, C.E.H , C.P.T.P, O.S.C.P >> I.T Security Analyst and Penetration Tester >> jgichuki at inbox d0t com >> >> {FORUM}http://lists.my.co.ke/pipermail/security/ >> http://chuksjonia.blogspot.com/ >> > > > -- > -- > Gichuki John Ndirangu, C.E.H , C.P.T.P, O.S.C.P > I.T Security Analyst and Penetration Tester > jgichuki at inbox d0t com > > {FORUM}http://lists.my.co.ke/pipermail/security/ > http://chuksjonia.blogspot.com/ > -- -- Gichuki John Ndirangu, C.E.H , C.P.T.P, O.S.C.P I.T Security Analyst and Penetration Tester jgichuki at inbox d0t com {FORUM}http://lists.my.co.ke/pipermail/security/ http://chuksjonia.blogspot.com/ -- -- Gichuki John Ndirangu, C.E.H , C.P.T.P, O.S.C.P I.T Security Analyst and Penetration Tester jgichuki at inbox d0t com {FORUM}http://lists.my.co.ke/pipermail/security/ http://chuksjonia.blogspot.com/

1 0

Router
by Chege 12 Oct '12

12 Oct '12

Hii all, Which strong wireless router do guys recommend in the market not cisco thou.. model no Rgds Chege

7 6

Looking for flash devs / designers
by Kiti Chigiri 12 Oct '12

12 Oct '12

Hi, A pal is looking for an experienced designer who is comfortable using Flash & Actionscript presentations for a project. If you fit the bill kindly get in touch offlist. Thanks Kiti Chigiri

2 1

collection of comments on Kenyan service providers
by Gichingiri Kuria 12 Oct '12

12 Oct '12

Hi all, We're collecting reviews of Kenyan service providers so that potential customers can have an idea of what to expect and poor service providers can see how to improve. So far we've got comments on a few banks and ISPs. We've done a bit of homework and now on a live test. What do you think about it? -- Gichingiri Kuria _________________________________________ www.website.co.ke / www.sokoletu.co.ke

3 5

Yahoo Account compromised
by Joseph Maina 12 Oct '12

12 Oct '12

Skunks A friend of mine had his yahoo account hacked , all his mails were deleted is there a way she can recover the mails? Maina

3 2

Safaricom "Pilot Testing on SDP Platform" developer
by Jangita Nyagudi 12 Oct '12

12 Oct '12

Hi, Looking for a developer who has/can implement the Polit testing on SDP that Safaricom is sending around to PRSPs. Please contact me offlist if interested. J

1 0

Interns Wanted
by Anna Berry 12 Oct '12

12 Oct '12

Hi all, Currently sourcing for interns for sales and marketing department and software development. If interested, kindly send me your CV off list. Best, Anna.

1 0

Re: [Skunkworks] opensource firewall
by William Muriithi 12 Oct '12

12 Oct '12

> > If you don't mind non-Linux, then pfSense is quite lightweight and very > powerful, with a GUI. > And for Linux firewall, this may be where you want to start http://www.shorewall.net/ Its just a nice wrapper if you don't want to get your hands dirty with iptables Muriithi > > > On Wed, Oct 10, 2012 at 5:26 PM, caroline mungai <njecaro(a)gmail.com> wrote: > >> Hi, >> >> Someone kindly recommend a easy to setup, easy to use linux firewall >> which will capture incoming and outgoing mails. >> >> -- >> carol........ >> >> Make a habit of raising your standards so that you work towards >> them...........it will always keep you on your toes. >> _______________________________________________ >> Skunkworks mailing list >> Skunkworks(a)lists.my.co.ke >> ------------ >> List info, subscribe/unsubscribe >> http://lists.my.co.ke/cgi-bin/mailman/listinfo/skunkworks >> ------------ >> >> Skunkworks Rules >> http://my.co.ke/phpbb/viewtopic.php?f=24&t=94 >> ------------ >> Other services @ http://my.co.ke >> > > > > -- > Best regards, > Odhiambo WASHINGTON, > Nairobi,KE > +254733744121/+254722743223 > _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ > I can't hear you -- I'm using the scrambler. >

3 2

my (not so merry) dev-experience with pesapal
by John Doe Smith Kamau KipNg'etich Jones 12 Oct '12

12 Oct '12

I'll be blunt... for a dev, pesapal integration is steeper than other (less established) payment gateways in other countries (at least Egypt & SA where integration is at per with paypal or moneybookers). It has its good sides... integration to all mobile money services in kenya, co-op, visa and mastercard!! whoa!! plus, it uses Oauth by default (or by force. no other option :-D)!! Interestingly... pesapal is just KES (so much that you never specify the currency you want to work with anywhere. Its just assumed to be KES, all the time. weird... never seen that before with the gateways i've worked with. I thought financial guys liked to be very explicit with their systems ) I tried to contact someone to have at least one issue fix (the first one, below)... but I got a very PR response. Moving along... Issue 1: The PHP documentation has very, VERY... very wrong code at some point, and its apparently been like that for months (a collegue argues since the beginning of pesapal). Though the code is PHP, it uses a request object available only in javascript (xmlHttpRequest). Check out the last two pages of the PDF for intergration using PHP... another collegue think its all part of a grand scheme to have people contact pesapal for help (and get billed for the assistance. Biz calls it "creating a need in the market") --> Solution: Update the darn code.... ask for my own code if you have to. Its only a small part of the sample code that is off. Its probably turned many potential customers to ipay... or some other gateway in the region __________________________________ Issue 2: PesaPal's code needs an urgent bugfix... Well... using pesapal's own sample code from their dev resources, amounts are posted to pesapal in the form "1,234.56". Note the comma "thousands-separator". Unfortunately, pesapal uses PHP (its a bad language. everyone knows that)... & one interesting thing is how php parses numbers. Basically, php parses numbers by the digit, stopping when it encounters a non-numeric value. To php, "345abceefg" is parsed to the number "345" .... and "1,234.56" is parsed to just "1" Since pesapal deals with finances, it must be very robust, and fail when it sees something like "345abc" instead of saying that the value is "345". Kept saying my "3,453.00" amount was just 3 bob. SOLUTION: if ( is_numeric($amount) === false ) { // FAIL, or THOW NEW EXCEPTION } .... and that's it. (i said pesapal uses php coz i think its the only language that parses numbers like that, AFAIK) __________________________________ Issue 3: It needs to be simpler.... Why the heck do I need to build some XML string, and post it.... it doesn't make the post any lighter, or anymore secure, or make anymore sense. It makes the request heavier with that XML envelope, and makes the whole thing prone to mistakes e.g. if I make a typo somewhere (which will be tricky to find in that XML mess)... come on! let me just post the payment details directly!! wtf!! and add some common API features.....pesapal has been around for so many years... but no new features! devs like new features! in my eyes, pesapal is still wearing granny undies as far as i'm concerned.. read the moneybookers PDFs for instance... cool stuf (i'll rarely use), but cool! basically... dont get too comfortable... evolve. __________________________________ Issue 4: No IPN (Instant Payment Notification). Even m-pesa has this (email me if you want the PDFs for m-pesa's IPN. It calls a URL on ur server when a payment comes in) .... back to the point: With no IPN, you're left with no choice but to have a cron-job regularly running to check the status of all pending payments you might have. The problem: 1) Increased server requirements: Not all hosts allow for cron-jobs, and many devs out there are pretty lazy and dont feel like they're being paid enough to even think about putting in the extra effort. 2) Increased costs on hosting, on both pesapal and its clients: In the event of mpesa/visa delays, my cronjob will make many useless requests to pesapal for my pending payments. These useless requests guzzle-up server and bandwidth resources on both my server and pesapal's. Its worse for pesapal, because the payment plugin I've built could run on 10 or 50 servers, and their cumulative hits would be hard on pesapal (think DenialOfService) 3) Increased code complexity: I now need to add a few fields to store pesapal's tracking ID, and keep track of pending payments, and do other bla bla bla. I'm not getting paid extra btw. My plugin is doing a lot of magic to work now... so much that it could star in a harry porter movie! (... yeah, nice joke :-D. twitting) -->SOLUTION: pesapal should build an IPN thingy, so some data is posted to a URL i provide only when the status of a payment changes. Will save pesapal a lot! they just dont know it! Reduced server & bandwidth load, increased ease-of-use of pesapal's API (i.e. more customers) .... I actually dont use a cronjob btw. My code aggresively makes repeated and consecutive requests to pesapal until the status of a payment changes. The script does this by using sockets to "call itself" whenever a payment is still pending. Too grumpy for effing cronjobs... so if my plugin proves too popular, pesapal could be DoS'd... and I'd probably feel very proud about that! (Cheers... your friendly neighbourhood script kiddie)

6 6