+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: Messiah Studio: Customizing costs with Parameter Pollution (/showthread.php?tid=3706238)
Messiah Studio: Customizing costs with Parameter Pollution - xQQ - Aug 21, 2013
Cheers,
I just found a security issue in http://www.projectmessiah.com/ where you can buy the 3D animation software Messiah: Studio. You can manipulate the http parameters to pay just as much as you like.
Head to the shop and click "Buy", then just intercept the request with Burpsuit or Tampadata (I am not going to explain this).
Spoiler (Click to View)
![[Image: 47bRc.JPG]](https://puu.sh/47bRc.JPG)
Change the value 299.00 to anything you like and you'll get instantly redirected to a paypal basket.
Spoiler (Click to View)
![[Image: 47bRz.JPG]](https://puu.sh/47bRz.JPG)
It's german but you'll get the idea.
Nothing special, just felt like sharing this. Make sure to stay anonymously if you're actually going to buy.
* - Naww - Aug 21, 2013
(Aug 21, 2013 05:04 AM)xQQ Wrote: Cheers,
I just found a security issue in http://www.projectmessiah.com/ where you can buy the 3D animation software Messiah: Studio. You can manipulate the http parameters to pay just as much as you like.
Head to the shop and click "Buy", then just intercept the request with Burpsuit or Tampadata (I am not going to explain this).
Spoiler (Click to View)
Change the value 299.00 to anything you like and you'll get instantly redirected to a paypal basket.
Spoiler (Click to View)
It's german but you'll get the idea.
Nothing special, just felt like sharing this. Make sure to stay anonymously if you're actually going to buy.
Nice find man, mind tellin how u found this?
Did u use a program, if u did plz me the name x)
THnx
* - mangdiabloz - Aug 21, 2013
(Aug 21, 2013 06:36 AM)Naww Wrote: Nice find man, mind tellin how u found this?
Did u use a program, if u did plz me the name x)
THnx
"Head to the shop and click "Buy", then just intercept the request with Burpsuit or Tampadata (I am not going to explain this). "
He did mention it. You can also use charles debugging proxy and using breakpoint to intercept request and respond.
* - xQQ - Aug 21, 2013
(Aug 21, 2013 06:36 AM)Naww Wrote: Nice find man, mind tellin how u found this?Do you mean how I found the website? I used[/code] google dorks for shopping sites.
Did u use a program, if u did plz me the name x)
THnx