Northern Mafia

Title: Northern Maffia / Northern-Maffia (note: "Maffia" is Dutch spelling)

Folder Name: nothern_mafia (typo: missing 'r' in "Northern")

Developer: Unknown (no credits found)

Website: www.northern-maffia.com / www.undernation.com/nm

Release Date: ~2005 (SQL dump: September 1, 2005)

Language: Dutch (Nederlands) - all UI, variable names, comments

Type: Dutch Mafia Browser RPG

Database: worldcrime_game / waushare_unation

Status: Abandoned (website dead, domain available)

Historical Context: Dutch browser gaming scene (2005-2008)

Archive Contains:

• 186 PHP files (24,740 lines)
• Database schema (2,215 lines SQL!)
• 58 GIF images (407 KB)
• 16 JPG images (769 KB)
• 2 SWF Flash files (474 KB)
• Sample data (user: "nicoow")

Sample Credentials (in code):

`php

// _include-config.php

mysql_connect("localhost","waushare_unation","un123")

mysql_select_db("waushare_unation")

`

Dutch Game Features:

• All text in Dutch (login = "Inloggen", wachtwoord = "Password")
• Dutch email templates ("Je wachtwoord is gereset")
• Dutch developer (Comments.txt mentions "Balis Hans", "Mr.X")
• Dutch domain references (northern-maffia.nl)

---

Core Architecture

Language: PHP 4.3.11 (from SQL header)

Database: MySQL 4.0.23 (MyISAM engine)

Framework: None (pure procedural PHP)

Structure: Include-based (globals pattern)

File Statistics:

• 186 PHP files (24,740 lines - large codebase!)
• Database: 2,215-line SQL dump (massive!)
• Largest files:
• snews.php (1,031 lines) - News system
• orgcrime.php (795 lines) - Organized crime
• zoek.php (618 lines) - Search system
• racetrack.php (567 lines) - Racing
• shop1.php (517 lines) - Shop system

Core Files:

`

index.php - Frameset launcher

_include-config.php - Database + globals (236 lines!)

_include-funcs.php - Utility functions

_include-jail.php - Jail check

login.php - Authentication (125 lines)

register.php - Registration (181 lines)

menu.php - Left menu

status.php - Status display (395 lines)

header.php - Top banner

`

Database Architecture (2,215-line SQL!):

31+ Tables (Dutch naming):

`sql

[auto] - Cars (soort, schade, owner, land)

[buildings] - Property (bulletfactory, roulette, slot, trainstation)

[cron] - Cron jobs

[detective] - Detective system

[donates] - Donations

[drank] - Drinks

[drugs] - Drug system

[families] - Family/gang system (Dutch: familie)

[garage] - Car garage

[getuige] - Witness system (Dutch)

[handdruk] - Handshake system (Dutch!)

[honourpoints] - Honor system

[land] - Countries (12 US states!)

[landen] - Travel system

[landen1] - Travel variant

[logs] - Action logs

[messages] - Mail system

[omnilog] - Omnipresent logging (POST/GET tracking!)

[online] - Online users

[orgcrime] - Organized crime

[temp] - Temporary data

[users] - Player accounts

`

Unique Tables:

• [handdruk] - "Handshake" system (alliance/treaty feature)
• [getuige] - "Witness" system (crime witnesses)
• [omnilog] - Complete POST/GET/IP logging (privacy nightmare!)

Buildings System (12 US states):

• California, Ohio, New York, Texas, Nevada
• New Jersey, Illinois, Colorado, Michigan
• Louisiana, Pennsylvania, Admin Palace

Building Types:

• bulletfactory (bullet production)
• roulette (casino)
• slot (slot machines)
• trainstation (travel hubs)

---

Complete Feature Set

1. Authentication System

• Login (PLAINTEXT passwords!)

`php

// login.php line 8

$dbres = mysql_query("SELECT login,activated

FROM [users]

WHERE login='{$_POST['login']}'

AND pass='{$_POST['pass']}'");

`

• Registration with IP check
• Email activation
• Password recovery (via email)
• Cookie-based sessions

2. Family System (Gangs)

`

fam.php - Family overview

beginfam.php - Create family

joinfam.php - Join family

fambank.php - Family bank

famedit.php - Edit family

famgarage.php - Family garage

famshop.php - Family shop

famdonate.php - Donate to family

fammsg.php - Family messages

fampage.php - Family page

famprofile.php - Family profile

famlijst.php - Family list

`

Dutch Terminology:

• "Familie" = Family/Gang
• "Capo" = Captain (capoleden.php)
• "Baas" = Boss

3. Organized Crime (orgcrime.php - 795 lines!)

• Multi-player heists
• Requires: weapons, bullets, cars
• Success/failure mechanics
• Money/respect rewards

4. Crime System (crimes.php - 350 lines)

• Solo crimes
• Success rates
• Jail time
• Validation codes (anti-bot)

`php

// crimes.php line 324

$code = md5($codene)

`

5. Vehicle System

`

auto.php - Car management (validation MD5!)

autoshop.php - Buy cars

autorace.php - Car racing

auto_stelen.php - Steal cars (Dutch: "stelen" = steal)

garage.php - Personal garage

famgarage.php - Family garage

carsel.php - Car selection

`

6. Property/Buildings

`

bezit.php - Property overview (399 lines)

establishment.php - Buy buildings

est.php - Building management

`

12 Cities with buildings:

• Bullet factories (production)
• Roulette tables
• Slot machines
• Train stations

7. Economy

`

bank.php - Banking

banknieuw.php - New bank system

shop.php - Shop

shop1.php - Shop variant (517 lines!)

clanshop.php - Clan shop

famshop.php - Family shop

crewshop.php - Crew shop

`

8. Travel System

`

travel.php - Travel between cities

vliegveld.php - Airport (Dutch: "vliegveld")

`

12 US States:

California, Ohio, New York, Texas, Nevada, New Jersey, Illinois, Colorado, Michigan, Louisiana, Pennsylvania, Admin Palace

9. Items/Drugs

`

drug.php - Drug dealing

drank.php - Drinks (Dutch: "drank")

type.php - Item types

type_shop.php - Type shop

`

10. Combat

`

kill.php - Attack players

gijzelen.php - Kidnapping (Dutch: "gijzelen" - 350 lines!)

gta.php - GTA-style missions (313 lines)

hitlist.php - Hit list

deadlist.php - Dead players

`

11. Jail/Hospital

`

gevangenis.php - Prison (Dutch: "gevangenis")

jail.gif - Jail graphic

ziekenhuis.php - Hospital (Dutch: "ziekenhuis")

health.php - Health system

`

12. Justice System

`

rechtbank.php - Court (Dutch: "rechtbank")

getuige - Witness system

detective - Detective investigation

`

13. Honor System

`

honourpoints.php - Honor points

honourrank.php - Honor ranking

handdruk - Handshake/alliance (unique!)

`

14. Social Features

`

message.php - Messaging (367 lines)

playermess.php - Player messages

playermessa.php - Message management (499 lines!)

playermessadd.php - Add message

fammsg.php - Family messages

friend.php - Friends list

`

15. Crew System

`

crew-forum.php - Crew forum

crew-hq.php - Crew HQ

crew-messages.php - Crew messages (354 lines)

crew-topics.php - Crew topics

crew-messageadd.php - Add message

crewbank.php - Crew bank

crewdonate.php - Donate to crew

crewlog.php - Crew log

crewmail.php - Crew mail

crewshop.php - Crew shop

clan.php - Clan system (446 lines)

clanhq.php - Clan HQ

`

Multiple Group Systems:

• Families (familie)
• Crews
• Clans
• Handshake alliances

16. Forum System

`

forum.php - Forum

forum/ - Forum directory

crew-forum.php - Crew forum

`

17. Mini-Games

`

roulette.php - Roulette (345 lines)

slot.php - Slot machine

racetrack.php - Horse racing (567 lines!)

autorace.php - Car racing

gta.php - GTA missions

`

18. Market/Trading

`

veiling.php - Auction (Dutch: "veiling" - 407 lines!)

verkoop.php - Sell (Dutch: "verkoop")

`

19. Admin Panel

`

admin.php - Main admin

admin2.php - Admin level 2

admin3.php - Admin level 3

admin-basic.php - Basic admin

admin-donate.php - Donation management

admin-familie.php - Family admin

admin-msg.php - Message admin

admin-poll.php - Poll admin

admin-rechtbank.php - Court admin

admin-search.php - Search admin

adminmen.php - Admin menu

adminmen2-6.php - Admin menus 2-6

adminstats.php - Admin stats

maak-admin.php - Make admin

ipbanner.php - IP banning

straffen.php - Punishments (Dutch: "straffen")

`

Admin Features:

• User management
• Family management
• IP banning
• Punishment system
• Donation management
• Poll management
• Court management
• Statistics

20. Cron Jobs

`

_cron_day.php - Daily tasks

_cron_hour.php - Hourly tasks

_cron_week.php - Weekly tasks

_cron_month.php - Monthly tasks

_cron_horserace.php - Horse race automation

`

21. Other Features

`

poll.php - Polling

poll.inc.php - Poll includes

snews.php - News system (1,031 lines!)

zoek.php - Search (618 lines!)

toplijst.php - Top list

statistieken.php - Statistics

profile.php - User profile

user.php - User info

users.php - User list

online.php - Online users

testament.php - Testament/will

sollicitatie.php - Job application (Dutch: "sollicitatie")

huwelijk.php - Marriage (Dutch: "huwelijk")

lead.php - Leadership

overzicht.php - Overview

FAQ.php - FAQ

manual.htm - Manual

`

22. Payment System

`

betaal1.php - Payment page 1

betaal2.php - Payment page 2

betaal3.php - Payment page 3

betaalmenu.php - Payment menu

`

23. Miscellaneous

`

bullet.php - Bullets

bullet3.php - Bullet system 3

bulletcalculator.php - Bullet calculator

booze.php - Alcohol

bescherming.php - Protection (Dutch: "bescherming")

besturing.php - Control (Dutch: "besturing")

`

---

Security Score: 2/10 - Critical Vulnerabilities

CRITICAL FLAWS:

1. PLAINTEXT PASSWORD STORAGE

`php

// login.php line 8

$dbres = mysql_query("SELECT login,activated

FROM [users]

WHERE login='{$_POST['login']}'

AND pass='{$_POST['pass']}'");

`

ZERO password hashing! Passwords stored plaintext in database.

2. SOME SQL INJECTION PREVENTION (Inconsistent)

`php

// _include-config.php has addslashes() loop

foreach($_POST as $key => $value) {

if(gettype($_POST[$key]) == "array")

foreach($_POST[$key] as $key2 => $value2)

$_POST[$key][$key2] = addslashes($_POST[$key][$key2]);

else

$_POST[$key] = addslashes($_POST[$key]);

}

`

Good: Global addslashes() on POST/GET/COOKIE

Bad: Some files use quote_smart(), others don't

Inconsistent protection!

3. MD5 USED FOR VALIDATION ONLY

`php

// crimes.php line 324

$code = md5($codene) // Only for anti-bot validation!

`

MD5 used for validation codes, NOT passwords!

4. OMNILOG PRIVACY NIGHTMARE

`php

// _include-config.php lines 42-51

// Logs EVERY POST/GET request with IP, forwarded headers

mysql_query("INSERT INTO [omnilog]

VALUES(NOW(),'{$_COOKIE['login']}',

'{$_SERVER['REMOTE_ADDR']}','$forwardedFor',

'{$_SERVER['PHP_SELF']}','$postVars','$getVars')");

`

Tracks all user actions (POST/GET data, IPs, forwarded headers) - GDPR nightmare!

5. IP-BASED BANNING

`php

// _include-config.php

$dbres = mysql_query("SELECT id FROM [users]

WHERE IP='$clientIP' AND level<='-50'");

`

IP bans easily bypassed (VPN, mobile networks).

6. WEAK SESSION MANAGEMENT

`php

// Cookie-based auth (no httponly, no secure flags)

setcookie("login",$data->login,time()+606024,"/",

"http://www.northern-maffia.com/");

`

Vulnerable to:

• XSS cookie theft
• Session fixation
• No CSRF tokens

7. EMAIL IN CODE

`php

// login.php line 59

mail($data->email,"Northern-maffia","...",

"From: worldcrime crew n");

`

Hardcoded email references (worldcrime.nl, northern-maffia.com inconsistency).

8. IP MULTI-ACCOUNT CHECK

`php

// register.php line 45

$dbres = mysql_query("SELECT id FROM [users]

WHERE ip='$IP' AND ip!='84.81.71.218' AND health!='0'");

`

Whitelisted IP: 84.81.71.218 (developer's IP?) can create unlimited accounts!

---

Code Quality Score: 4/10 - Messy Hobbyist Code

STRENGTHS:

1. Global Sanitization

`php

// _include-config.php - loops through all inputs

foreach($_POST as $key => $value) {

$_POST[$key] = addslashes($_POST[$key]);

}

`

Better than nothing! (Though inconsistent usage elsewhere)

2. Function Library

`php

// _include-funcs.php

// quote_smart(), check_login(), etc.

`

3. OmniLog Audit Trail

`php

// Every action logged (POST/GET/IP)

// Good for debugging, terrible for privacy

`

4. Modular Structure

• Separate files per feature
• Include-based globals
• Cron job separation

WEAKNESSES:

1. MASSIVE FILES

`

snews.php - 1,031 lines (news system)

orgcrime.php - 795 lines (organized crime)

zoek.php - 618 lines (search)

racetrack.php - 567 lines (racing)

shop1.php - 517 lines (shop)

`

2. DUTCH/ENGLISH MIX

`php

// Variable names

$wachtwoord // Dutch: password

$gevangenis // Dutch: prison

$familie // Dutch: family

$baas // Dutch: boss

`

Confusing for international developers!

3. NO COMMENTS

• Almost zero code documentation
• No function descriptions
• Magic numbers everywhere

4. INLINE HTML

`php

print <<

ENDHTML;

`

No template engine (HTML/PHP spaghetti).

5. INCONSISTENT NAMING

`

crew-forum.php // Hyphenated

crewbank.php // No hyphen

fambank.php // Different prefix

`

6. FILE ORGANIZATION CHAOS

• 186 PHP files in root directory
• No subdirectories (except forum/, images/, eng/)
• Hard to navigate

7. DUPLICATE CODE

`

shop.php vs shop1.php

admin.php, admin2.php, admin3.php

message.php, playermess.php, playermessa.php

`

8. DEPRECATED PHP

`php

mysql_connect() // Deprecated PHP 5.5

mysql_query() // Removed PHP 7.0

ereg() // Removed PHP 7.0 (if used)

`

---

Database Schema (2,215 lines!)

[users] Table (Massive!):

`sql

id, login, pass (PLAINTEXT!), email, activated,

level, money, bank, bullets, health, maxhealth,

respect, rank, power, defense, speed,

kills, deaths, location, IP, signup,

online, familie (family ID), type,

getuige (witness count), handdruk (handshake/alliances),

honourpoints, donator

`

[families] Table:

`sql

id, name, boss (leader), motto, respect,

money, bank, level, wins, losses,

members, maxmembers, garage (cars)

`

[buildings] Table:

`sql

type (bulletfactory/roulette/slot/trainstation),

city (12 US states), owner, start, price,

production, profit, active, amount

`

[orgcrime] Table:

`sql

id, leader, member1-4, type, status,

money, bullets, cars, weapons, success

`

[omnilog] Table (Privacy Nightmare!):

`sql

time, login, IP, forwardedFor, page,

postVars (serialized POST data!),

getVars (serialized GET data!)

`

Logs EVERYTHING users do!

[handdruk] Table (Unique Feature!):

`sql

user1, user2, status, timestamp

`

"Handshake" = Alliance/treaty system (unique mechanic!)

---

Dutch Browser Gaming (2005)

Context:

Northern Mafia is part of Dutch gaming wave (2004-2008):

Dutch Games Discovered:

• Mafia Warz (game 46) - Dutch developer, never released
• Northern Mafia (game 48) - This game
• MCCodes v2.0 (game 47) - Powered Barafranca (Dutch success)

Why So Many Dutch Games?

• English fluency (target international players)
• Strong web dev culture (Amsterdam tech hub)
• Barafranca success (inspired clones)
• Gaming culture (mafia theme popular)

Northern Mafia Characteristics:

• All-Dutch UI (login, wachtwoord, familie, baas, gevangenis)
• Dutch developer (Comments.txt: "Balis Hans", "Mr.X")
• Dutch domains (northern-maffia.nl, worldcrime.nl)
• 12 US states (targeting international audience)

Unique Features:

• Handshake system ([handdruk] table) - alliance mechanic
• Witness system ([getuige]) - crime witnesses
• Multi-group hierarchy (families, crews, clans)
• Building ownership (12 cities, 4 building types)
• Kidnapping (gijzelen.php - 350 lines!)
• OmniLog (complete action tracking)

Technology Stack (2005):

• PHP 4.3.11
• MySQL 4.0.23
• MyISAM engine (no transactions)
• Pure procedural PHP
• Cookie-based sessions
• Plaintext passwords (unacceptable even in 2005!)

Why It Failed:

• Catastrophic security (plaintext passwords!)
• Never finished (admin palace location unimplemented)
• No launch (only sample data: "nicoow")
• Competition (Barafranca dominated Dutch market)
• Domain issues (northern-maffia.com vs .nl inconsistency)

---

System Requirements

Server:

• Linux/Windows
• Apache
• PHP 4.3+ (won't work PHP 7+)
• MySQL 4.0+

Installation:

• Create database
• Import Database....sql (2,215 lines!)
• Edit _include-config.php (database credentials)
• Upload files
• Visit index.php

Configuration:

`php

// _include-config.php

$sitelink = "http://www.undernation.com/nm";

mysql_connect("localhost","waushare_unation","un123")

mysql_select_db("waushare_unation")

`

Modern Deployment: IMPOSSIBLE

Blockers:

• Plaintext passwords (instant hack!)
• mysql_* functions (removed PHP 7.0)
• No HTTPS (hardcoded http:// cookies)
• Privacy violations (OmniLog tracks everything)
• IP bans ineffective (VPNs bypass)

Would require complete rewrite: 300+ hours

---

Completeness Score: 8/10 - Nearly Complete

What's Present:

• Full source code (186 PHP files, 24,740 lines)
• Database schema (2,215-line SQL!)
• Sample data (user "nicoow", buildings)
• Images (58 GIF, 16 JPG)
• Flash files (2 SWF)
• Comments.txt (development notes)
• Multiple admin levels

What's Missing:

• Documentation
• Installation guide
• License
• Credits
• Manual (manual.htm exists but empty)

Playability:

`

PHP 5.6: ⚠️ YES (works but INSECURE!)

PHP 7.0+: NO (mysql_* removed)

Security: CATASTROPHIC (plaintext passwords!)

`

Cultural Value: MEDIUM

Historical Significance:

• Dutch gaming scene artifact
• Unique features (handshake, witness systems)
• Multiple group hierarchies
• Building ownership system
• OmniLog privacy case study
• ⚠️ Never launched (limited impact)

Comparative Rarity:

• Unique: Handshake alliance system
• Unique: Witness system for crimes
• Rare: OmniLog complete tracking
• Common: Mafia theme
• Rare: All-Dutch interface

In Wild:

• northern-maffia.com: Dead
• northern-maffia.nl: Dead
• worldcrime.nl: Dead (old brand reference)
• No community found
• Estimated copies worldwide: <5

---

Overall Rating: 4/10 - Ambitious But Flawed

RATING BREAKDOWN:

STRENGTHS:

1. Unique Mechanics

• Handshake system ([handdruk]) - alliance/treaty feature
• Witness system ([getuige]) - crimes have witnesses
• Multi-tier groups (families, crews, clans)
• Building ownership (12 cities, production/profit)
• Kidnapping (gijzelen.php - 350-line system!)

2. Large Codebase

• 186 PHP files (24,740 lines)
• 2,215-line database schema
• Multiple admin levels
• Complete feature set

3. OmniLog Audit System

• Tracks all POST/GET/IP
• Perfect debugging tool
• Terrible privacy nightmare

4. Dutch Cultural Artifact

• All-Dutch interface
• Dutch terminology (familie, baas, gevangenis)
• Part of Dutch gaming wave (2005-2008)

CRITICAL FLAWS:

1. PLAINTEXT PASSWORDS

`php

// NO HASHING ANYWHERE!

WHERE login='{$_POST['login']}'

AND pass='{$_POST['pass']}'

`

Worst security flaw possible!

2. Privacy Violations

`php

// OmniLog tracks EVERYTHING

// POST data, GET data, IPs, forwarded headers

// GDPR nightmare!

`

3. Code Quality Issues

• Dutch/English variable mix
• 1,031-line files
• No comments
• 186 files in root
• Inline HTML everywhere

4. Never Launched

• Only sample data ("nicoow")
• Admin Palace location unimplemented
• No community
• No impact

5. PHP 4.3 Maximum

• mysql_* deprecated
• Won't run PHP 7+
• Dead codebase

Deployment Recommendation: NEVER DEPLOY

Reasons:

• Plaintext passwords = instant hack
• OmniLog = privacy lawsuit
• mysql_* removed PHP 7.0
• No HTTPS support
• IP bans ineffective

Educational Value: 6/10 - Privacy Case Study

Who Should Study:

• Privacy researchers - OmniLog tracking example
• Security students - Plaintext password anti-pattern
• Historians - Dutch gaming scene
• Game designers - Handshake/witness mechanics

Teaching Points:

• Privacy: OmniLog = what NOT to do
• Security: Plaintext passwords = catastrophic
• Localization: Dutch/English mix problems
• Innovation: Unique alliance/witness systems

Historical Significance: LOW

The Northern Mafia Story:

2005: Unknown Dutch developer creates game

• 186 PHP files, 24,740 lines
• 2,215-line database
• Unique mechanics (handshake, witness)
• All-Dutch interface

September 1, 2005: Database dump created (last activity?)

2005: Project abandoned

• Plaintext passwords
• Never launched
• No community
• Domain issues

2005-2025: Lost to history

• Domains dead
• No documentation
• Only archive survives

The Lesson: Innovation without security = failure

Northern Mafia had unique features (handshake alliances, witness system, kidnapping, building ownership) but catastrophic security prevented launch. Plaintext passwords were unacceptable even in 2005.

Meanwhile, Barafranca (Dutch, 2003) with basic security survived 22 years because it launched and built community.

Comparison to Previous Games

In Collection (Games 1-48):

• TIED WORST SECURITY: 2/10 (with Mob Star, Mafia Warz)
• Second in Dutch games: After Mafia Warz
• UNIQUE: Handshake alliance system
• UNIQUE: Witness crime system
• UNIQUE: OmniLog complete tracking
• LARGEST: 2,215-line SQL schema (biggest yet!)

Tier Classification: TIER 4 - Amateur, Never Released

Comparison:

• Northern Mafia (game 48): 4/10, unique systems, catastrophic security
• Mafia Warz (game 46): 3/10, Dutch, never released
• Night (game 44): 4/10, Russian, multi-database
• MCCodes (game 47): 9/10, LEGENDARY engine

Preservation Priority: MEDIUM

Justification:

• Unique mechanics (handshake, witness systems)
• Dutch gaming artifact (2005 era)
• OmniLog case study (privacy anti-pattern)
• Large codebase (186 files, 24,740 lines)
• Never launched (limited historical impact)
• Security disaster (worst practice example)

Archive Value: Educational (privacy/security case studies)

---

Archive Status: PRESERVED (Dutch Gaming Artifact)

Analysis Date: December 11, 2025

Game Number: 48 of 79

Analyst Notes: "Northern Maffia" (Dutch spelling). Folder typo: "nothern_mafia" (missing 'r'). Catastrophic security (plaintext passwords, 2/10). Large codebase (186 PHP files, 24,740 lines, 2,215-line SQL!). Unique features: handshake alliance system ([handdruk] table), witness system ([getuige]), kidnapping (gijzelen.php - 350 lines), building ownership (12 US cities), multi-tier groups (families/crews/clans). OmniLog privacy nightmare - tracks all POST/GET/IP data. All-Dutch interface (login/wachtwoord/familie/baas/gevangenis). Never launched (only sample data: user "nicoow"). PHP 4.3.11, MySQL 4.0.23 (September 1, 2005). Domains dead (northern-maffia.com, worldcrime.nl). Developer: Balis Hans, Mr.X (from Comments.txt). Worth preserving for unique mechanics and privacy anti-patterns, but zero historical impact (never released). Messy code (Dutch/English mix, 1,031-line files, no comments). Part of Dutch gaming wave 2005-2008 but failed where Barafranca succeeded.