Hacked into many websites using Business Logic bypass in no time
Hi, Guys hope you all are doing well, fine, and healthy. I'm back with another finding
Introduction :
I’m Gajendra working as Penetration Tester. Today I am going to share how I found Business logic bypass from one website to many.
About Target discovery:
While surfing on the internet I came across one site which was selling and listing different products on their website. Having different functionalities like Add to cart, Apply coupon, etc. Consider being the best site to pentest.
While recon I found one API endpoint which is responsible for coupon verification catch my attention and I started Fussing with the request I got to know that the one parameter is not validating on the server side
By tampering with the parameter, I was able to place an order with any discount on the checkout amount. I start digging into the API call after a little recon I got to know that the application was using 3rd party API solution.
I would like to recommend wappalyzer extension which shows me the list of the associate website which are using vulnerable API calls on their website. I checked most of the websites and perform the same action and Boooom I was able to exploit the vulnerability.
It started from one website to many websites with the same vulnerability. The key point here is “Recon is the key to success”. Quickly I created POC and reported to the 3rd party API solution company. (catch the bigger fish over the small fish )
Get Gajendra’s stories in your inbox
Join Medium for free to get updates from this writer.
Step to Reproduce:
- Login into the application and add the products to the cart
- Now Apply the store offer which was 100RS max and intercept the request.
3. change the “discount” value from 0 to 10000 and sent the request to the server
3. Boom the store discount was reflected in the Grand total (7032 RS+300 RS–100 RS–10000RS = -2768 RS)
Key points from the writeup :
Recon your target deeply and check every input field/ default parameter/endpoint. Use the different tools for your effective testing
Hope you like the article. Thanks for reading.
you can contact me on
