[mustmuck]

Yeah, usually with these smaller sites hole card viewing is very possible. Given that their software is usually poorly written, and as you say they have no security department, a couple of weeks analysis of their communications protocols should give you sufficient information to mount an attack. You don't sound like you know much about cracking though, so you'll probably have to investigate the dark art itself for a while first.