paulwhitehouse
Carding Novice
- Joined
- 26.09.26
- Messages
- 1
- Reaction score
- 0
- Points
- 1
What I can usually get from a shell / SSH:
- Full app DB (customer / order / quote / admin tables — PII + full order history). Payments go through tokenized gateways, so usually no raw card numbers in the DB.
- Live payment-gateway API keys sitting in app config (Razorpay, Stripe, Braintree, PayPal — key_id + secret). Can read orders / payments / customers, and in some cases initiate refunds / touch settlements.
- App config — SMTP creds, 3rd‑party API keys, webhooks, service‑account secrets.
- Web root + /uploads (old backups, .env, config files show up).
- Sometimes SSH / sudo, cron, logs, shell history, other services on the same box.
To be concrete — a few examples of the average boxes I currently have shell / SSH on (numbers are approximate):
- Dental‑lab (B2B, high‑volume) — ~1,700 orders/month (AOV ~$235) / ~600 customers / ~30 admin accounts. Full DB: customer PII (name, email, company, full
billing + shipping address, phone), complete **sales / order history** (dates, items, qty, unit price, totals) — **mostly B2B credit terms (invoice, no card on page)** with a portion via a charge gateway — admin accounts, live gateway keys.
- Dental‑lab ecom (B2B) — ~600 customers / ~1,400 orders / ~$1.2M lifetime revenue. Full DB: customer PII (name, email, company, full billing + shipping address, phone), complete **sales / order history** (dates, items, qty, unit price, totals), admin accounts, live gateway keys.
- International ecom (mostly CJK buyers) — ~130K registered customers (only ~350 with actual orders) / ~$180K revenue. Customer PII + order history + payment config.
- Glass / construction‑trade ecom (B2B) — ~1,200 customers / ~260 orders / ~$95K revenue. PII + order history + gateway keys.
- US consumer ecom — ~5,500 customers / ~8,600 orders / ~$2.8M revenue. PII + dense order history + gateway keys.
So in the DB I have: full sales / order history, customers (PII — name, email, phone, full billing + shipping address, company), admin accounts, live payment‑gateway keys (read + in some cases refund / settlement), app config (SMTP / API / webhook secrets), web root + uploads, and sometimes SSH / sudo + cron + logs.
Question — What do people actually pay for out of the above? What will people pay for the above dumps (no cards), and where should I sell them?
- PII + order history (no card data) — worth anything, or just spam‑list tier?
- Live gateway keys (the refund / settlement kind) — does anyone buy those, or is that a "use it yourself" thing?
- What verticals / data types are in demand — B2B trade, consumer PII, specific industries?
- Is raw RCE / SSH worth selling as‑is, or should I always extract data first?
- What about selling some other service that uses the box
On card skimmers — why they work on some sites and not others, and what it takes to make them work:
A JS/DOM skimmer only captures a card if the number is typed into a form on the merchant's own page. The browser's same‑origin policy blocks the script from reading anything typed inside a cross‑origin iframe — so when a checkout hands the card off to the gateway's own page, a plain skimmer is blind. In practice checkouts fall into a few patterns, and only one is cleanly skimmable:
- On‑page card form — the merchant renders the card fields on their own page. The only case a DOM skimmer can capture (a few % of card transactions). Relatively rare.
- Hosted / iframe / redirect checkout — the gateway renders the fields on its own page/iframe (hosted fields, redirect, PayPal Express). Entered cross‑origin → invisible to the script. The most common case.
- B2B credit terms / invoice — on trade/B2B stores, most orders are paid by invoice or credit terms, so there's no card on the page at all.
- COD / bank transfer — no card to capture.
The two ways to "make it work" on the hosted ones — and this is where I'm unsure what's worth doing:
- Overlay a fake form — inject a script that hides the gateway's iframe and draws a visually identical form on the merchant's own page, skims what's typed, beacons it out, then hands the user back into the real checkout so it doesn't fail. This works without touching the merchant's gateway account (just code/DB access to inject the script). The catch: it's fiddly and higher‑risk — modern checkouts are complex state machines, so a bad injection breaks transactions (spikes in failed checkouts are how merchants usually notice a skimmer), and a strict CSP or file‑integrity monitoring can stop the script cold.
- Flip the gateway to on‑page (direct/API) mode — cleaner, but it requires the merchant to enable "direct API / custom checkout" in their gateway dashboard. Without that, the gateway rejects the raw card payload (403 / "feature not enabled") and the checkout breaks — so it's usually not something an outsider can do.
So the honest state: most of these stores are hosted/iframe/redirect, credit‑terms, or COD, so a plain DOM skimmer yields only a trickle (tens of cards/mo at best across the whole set). The overlay approach gets more, but it's the higher‑risk, higher‑effort option (a few hours' work per site, real chance of breaking the checkout). Only the sites with a genuine on‑page card form are worth a plain skimmer. Furthermore, if we don't get SSH access, the persistence is often very short lived.
Question: is anyone actually paying for the overlay / fake‑form approach on hosted checkouts, or is that mostly a "use it yourself" thing? And is the break‑the‑checkout risk a dealbreaker for most buyers?
- Full app DB (customer / order / quote / admin tables — PII + full order history). Payments go through tokenized gateways, so usually no raw card numbers in the DB.
- Live payment-gateway API keys sitting in app config (Razorpay, Stripe, Braintree, PayPal — key_id + secret). Can read orders / payments / customers, and in some cases initiate refunds / touch settlements.
- App config — SMTP creds, 3rd‑party API keys, webhooks, service‑account secrets.
- Web root + /uploads (old backups, .env, config files show up).
- Sometimes SSH / sudo, cron, logs, shell history, other services on the same box.
To be concrete — a few examples of the average boxes I currently have shell / SSH on (numbers are approximate):
- Dental‑lab (B2B, high‑volume) — ~1,700 orders/month (AOV ~$235) / ~600 customers / ~30 admin accounts. Full DB: customer PII (name, email, company, full
billing + shipping address, phone), complete **sales / order history** (dates, items, qty, unit price, totals) — **mostly B2B credit terms (invoice, no card on page)** with a portion via a charge gateway — admin accounts, live gateway keys.
- Dental‑lab ecom (B2B) — ~600 customers / ~1,400 orders / ~$1.2M lifetime revenue. Full DB: customer PII (name, email, company, full billing + shipping address, phone), complete **sales / order history** (dates, items, qty, unit price, totals), admin accounts, live gateway keys.
- International ecom (mostly CJK buyers) — ~130K registered customers (only ~350 with actual orders) / ~$180K revenue. Customer PII + order history + payment config.
- Glass / construction‑trade ecom (B2B) — ~1,200 customers / ~260 orders / ~$95K revenue. PII + order history + gateway keys.
- US consumer ecom — ~5,500 customers / ~8,600 orders / ~$2.8M revenue. PII + dense order history + gateway keys.
So in the DB I have: full sales / order history, customers (PII — name, email, phone, full billing + shipping address, company), admin accounts, live payment‑gateway keys (read + in some cases refund / settlement), app config (SMTP / API / webhook secrets), web root + uploads, and sometimes SSH / sudo + cron + logs.
Question — What do people actually pay for out of the above? What will people pay for the above dumps (no cards), and where should I sell them?
- PII + order history (no card data) — worth anything, or just spam‑list tier?
- Live gateway keys (the refund / settlement kind) — does anyone buy those, or is that a "use it yourself" thing?
- What verticals / data types are in demand — B2B trade, consumer PII, specific industries?
- Is raw RCE / SSH worth selling as‑is, or should I always extract data first?
- What about selling some other service that uses the box
On card skimmers — why they work on some sites and not others, and what it takes to make them work:
A JS/DOM skimmer only captures a card if the number is typed into a form on the merchant's own page. The browser's same‑origin policy blocks the script from reading anything typed inside a cross‑origin iframe — so when a checkout hands the card off to the gateway's own page, a plain skimmer is blind. In practice checkouts fall into a few patterns, and only one is cleanly skimmable:
- On‑page card form — the merchant renders the card fields on their own page. The only case a DOM skimmer can capture (a few % of card transactions). Relatively rare.
- Hosted / iframe / redirect checkout — the gateway renders the fields on its own page/iframe (hosted fields, redirect, PayPal Express). Entered cross‑origin → invisible to the script. The most common case.
- B2B credit terms / invoice — on trade/B2B stores, most orders are paid by invoice or credit terms, so there's no card on the page at all.
- COD / bank transfer — no card to capture.
The two ways to "make it work" on the hosted ones — and this is where I'm unsure what's worth doing:
- Overlay a fake form — inject a script that hides the gateway's iframe and draws a visually identical form on the merchant's own page, skims what's typed, beacons it out, then hands the user back into the real checkout so it doesn't fail. This works without touching the merchant's gateway account (just code/DB access to inject the script). The catch: it's fiddly and higher‑risk — modern checkouts are complex state machines, so a bad injection breaks transactions (spikes in failed checkouts are how merchants usually notice a skimmer), and a strict CSP or file‑integrity monitoring can stop the script cold.
- Flip the gateway to on‑page (direct/API) mode — cleaner, but it requires the merchant to enable "direct API / custom checkout" in their gateway dashboard. Without that, the gateway rejects the raw card payload (403 / "feature not enabled") and the checkout breaks — so it's usually not something an outsider can do.
So the honest state: most of these stores are hosted/iframe/redirect, credit‑terms, or COD, so a plain DOM skimmer yields only a trickle (tens of cards/mo at best across the whole set). The overlay approach gets more, but it's the higher‑risk, higher‑effort option (a few hours' work per site, real chance of breaking the checkout). Only the sites with a genuine on‑page card form are worth a plain skimmer. Furthermore, if we don't get SSH access, the persistence is often very short lived.
Question: is anyone actually paying for the overlay / fake‑form approach on hosted checkouts, or is that mostly a "use it yourself" thing? And is the break‑the‑checkout risk a dealbreaker for most buyers?
