League Of Legends Hacked

[Fisseha Aranda]

Ive been using a legitimate app called Porofessor that provides a lot of helpful info when playing league of legends, such as displaying objective / jungle camp timers when things will respawn (such as dragon, baron, jungle camps etc), showing player histories like champ statistics, win rates, etc, and also suggests runes and can auto-fill them into your slots to make it easier to prep for a match.

The jungle timers in the app will go off for camps the player doesn't have vision of, for example often times i'll see a camp on the opponents side suddenly show a timer, and will realize that their jg must have just cleared it and is in that location, even though i've got no vision there.

Update - I was wrong; apparently it was showing them when a camp was about to respawn, at 60's , not when it was just killed. So I would be recognizing that the JG should be there soon rather than just cleared it. Coincidence

Based on those quoted sections, this would be considered cheating. You're only supposed to know jungle timers if you see the camp being cleared; seeing a timer after the enemy jungler has cleared a camp outside of your team's vision is not okay. You should report it to the Porofessor developers so they can make changes to the jungle timer overlay.

In this post, I'll show you how to rediscover the email of your 8-year-old RIOT account (which you obviously registered with a bullshit email). From a security perspective, ill paint an attack scenario demonstrating the risks of buying RIOT accounts & how someone with malicious intentions could go about hijacking it.

This is the attack scenario: I'm a bad guy and I've obtained your riot account credentials. Naturally, the first thing I'd try is to login to Riot's main webpage Since the login is a username and password I don't know what email the account is bound to. My goal as a bad guy is to identify the email address associated with the account through Riot's ticketing systems and hope that the password of the account is being reused on the email.

Keep in mind that you need email access to properly perform account authentication to perform a full account takeover by accessing the accounts settings. Here is where you might hit a brick wall. If you're not redirected to the accounts settings page you'll be presented with the following image.

To obtain this code you'll need access to that account's email. Now like me if you've forgotten the email you used to register your account you're pissed off. To my knowledge, besides the way I'm about to show you I haven't found another way to disclose account emails (but I'm sure there are other ways). To obtain the account's email you will need to head over to -leagueoflegends.riotgames.com/hc/en-us/requests. You won't need any 2FA checks or additional information past the username and password of the account.

If not, you will need to create a "General Question" ticket. If you submit any other type of tickets such as a "Ban or Restriction" then that account will be locked by support as those processes seem to require a long list of additional identifying information. It genuinely doesn't matter what you ask here, the only goal is to have the account create a ticket.

Once you have a ticket created since they're using Zendesk simply open the ticket and view the source of the page. At the complete bottom, you'll find the email tied to that League of Legends account.

All vulnerabilities discovered in account boosting sites have been responsibly disclosed to the site owners and are remediated. Additionally, all screenshots are from accounts I personally created and own. This is simply to illustrate an attack scenario and to help you recover your account email should you ever happen to forget.

Lastly, this blog is a result of Riot Games suspending my GrandMaster account because I couldn't remember the email tied to that account. While submitting a support ticket to identify my account's email the account was suspended as I couldn't be vetted as the legitimate owner.

3a8082e126