Breaking PortSwigger’s Logic Flaw Lab with Integer Overflow & Modular Math

When I first encountered the "High-level logic vulnerability" lab on PortSwigger Web Security Academy, the traditional solution was obvious and found on Youtube: abuse the cart's logic using negative quantities. But where is the fun in this lab ?

In this writeup, I will show you the standard intended solution, and then walk you through how I used 32-bit integer limits, modular arithmetic, and a bit of AI prompting to buy a $1,337 jacket for just $1.

Objective & Credentials

• Objective: Purchase the "Lightweight l33t leather jacket"
• Credentials: wiener : peter

Method: Integer Overflow Attack (Custom Approach)

Prerequisites

• Tools / Environment: Kali Linux, Windows, or macOS, plus any AI tool (to calculate modular arithmetic).
• Required Knowledge: Modular arithmetic, signed integers, and integer overflow vulnerabilities.

Step-by-Step Execution

Step 1: Understanding the Math

We will exploit an integer overflow vulnerability caused by an excessively large input quantity. The goal is to force the total price to exceed the maximum value of a 32-bit signed integer (2³¹ — 1, which equals 2,147,483,647), causing the memory calculation to wrap around into negative values or a lower positive range.

The jacket costs $1,337, and the application calculates the total as: Total Price = 1337 x Quantity

To find the minimum quantity needed to trigger an overflow, divide the maximum 32-bit integer limit by 1337: 2147483647 / 1337 = 1606195.69

Rounding this up gives 1,606,196 items.

Step 2: Testing the Overflow

Enter 1,606,196 into the quantity field. The total price becomes significantly lower than expected due to integer overflow. (Note: Always clear previous cart items before testing new quantities).

Step 3: Halving the Input

Halve the quantity to see if the total price decreases proportionally. Halving the quantity drops the calculated total price by half as expected.

Step 4: Finding the Boundary Limit

Halve the quantity again. This time, the price resets because the total value drops below the maximum limit of 2,147,483,647, resolving the overflow condition and returning to normal pricing logic.

Due to modular arithmetic behavior, entering 401,549 yields no result, so test with 401,548 instead.

Step 5: Calculating the Target Price with AI

To ensure the final cart total remains under $100 (matching our store balance), use an AI assistant like Gemini Pro to compute the exact modular value required.

Prompt used:

"Find the modular arithmetic value that results in a total price < 100 based on the following logic: total price = 1337 * quantity. Entering 1,606,196 results in a total price of 404, and 803,098 results in 202."

Step 6: Checkout

Enter the calculated quantity into the field. Selecting the optimal calculated number reduces the total price to just $1, leaving $99 in store credit and allowing successful checkout.