None

Okay, I told you in part 1 how to dig through a little information and identify the system and use it to perform a chain attack. Now, at the end of that, I said that I hacked the entire system. Let's see the rest of the part here.

So, come and read as usual today. Let's get down to business. I turned on the proxy and logged in again until I went to the place where I made a full payment. Then, when I checked the history, I saw a POST request related to the relevant order. The content there surprised me, it was like this,

Req = 
cart_data=%7B%22items%22%3A%5B%7B%22id%22%3A%223%22%2C%22name%22%
3A%22Monthly%22%2C%22price%22%3A75%2C%22qty%22%3A1%2C%22line_total%22
%3A75%7D%5D%2C%22total_amount%22%3A75%2C%22total_qty%22%3A1%2C%22cu
rrency%22%3A%22LKR%22%7D&cart_total=75.00&currency=LKR&player_id=xxxx
&player_name=Z%C3%A1%C2%B4%C2%87%C3%A1%C2%B4%C2%9Cs_O%C3%89%C
2%B4F%C3%89%C2%AA%C3%8A%C2%80%C3%A1%C2%B4%C2%87%C3%AF%C2%A3
%C2%BF&player_level=65&customer_contact=dacohom848%40gavrom.com&payment=c
ard

Then when I converted it to a url, this is what came up,

as a real =  
cart_data={"items":[{"id":"3","name":"Monthly","price":75,"qty":1,"line_total":75}],"total_amo
unt":75,"total_qty":1,"currency":"LKR"}&cart_total=75.00&currency=LKR&player_id=44&pla
yer_name=Zá´ á´ s_OÉ´FÉªÊ á´ ï£¿&player_level=65&customer_contact=dacohom848
@gavrom.com&payment=card
None

Then, I changed the price while keeping the item id the same and sent the request, but the server recognized the item and gave me an error. An error means that what I actually got was the same price for the item. No matter how many times I tried, I got it. Then,

I looked at the lowest priced item on the site again, and it was priced at 75. Then I chose a new item with a higher price and grabbed the post req for it. The price was about 11000 (greed :( ) Then I edited the body like this. In this, I put the price in the lowest priced item on the site, which is 75, but the item I put in was the higher price. Then I sent the request,

Boom….!

11000 item for 75 price manipulation done..

None

i hacked 3 person for testing,

None

after that, i make fully step by step like quality report and sent it to site owner, as well as few days ago i checked that all fix…

here,

None

so thanks for read. see u soon

blackmambaa001