PortSwigger - Business Logic Vulnerabilities - Lab 1

Lab 1 - Excessive trust in client-side controls

Lab Objective:

This lab doesn’t adequately validate user input. You can exploit a logic flaw in its purchasing workflow to buy items for an unintended price. To solve the lab, buy a “Lightweight l33t leather jacket”.

You can log in to your own account using the following credentials: wiener:peter

Reference:
Port Swigger - Lab 1
Rana Khalil - Business Logic Vulnerability - Lab1
Python Script

Solution

---

1. Login in with provided credentials wiener:peter

2. Click on Home to see the shop.

3. Click on view Details for the Lightweight "l33t" Leather Jacket product

4. Intercept the request to Add Lightweight "l33t" Leather Jacket to your cart.

5. Change the price in the above request

6. Navigate to your cart and purchase the Lightweight "l33t" Leather Jacket for $0.01

---