> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/web/business-logic/logical-flaw-allowing-you-to-generate-infinite-money.md). # Logical Flaw Allowing You to Generate Infinite Money Logical Flaw Allowing You to Generate Infinite Money notes for PortSwigger Web Security Academy labs, including exploitation workflow, payload testing, Burp Suite validation, and remediation context. ### Infinite Money Logic Flaw **Description of lab** This lab contains a logical flaw in the purchasing process. By using a bad interaction between \*\* gift cards\*\*, \*\* promotional coupons\*\* and **order confirmation**, it is possible to generate credit unlimitedly, then buy the Lightweight l33t leather jacket. Identifier provided: * **User**: wiener * **Password**: peter
### Fault Principle After registration for the newsletter, a promotional coupon is awarded: * **Coupon** : `SIGNUP30`
In the shop it is possible to buy \*\* gift cards\*\*. The problem is that the coupon can be applied when purchasing these cards.
#### Initial Exploitation Example * Purchase of a gift card of **$10** * Coupon application `SIGNUP30` * Final price paid: **$7**
* Receipt of a **gift card code** (example: `DbWseYFi2v`)
When this code is used in the Gift Cards section, the account balance increases by **10$** while only **7$** was spent. The net gain is therefore **$3**, increasing the total credit to **$103**.
### Logic Issues Identified 1. The coupon can be used **several times** to buy gift cards. 2. Credit for gift cards is **still applied at full value**, regardless of the price actually paid. 3. Order confirmation via the endpoint: ```bash /cart/order-confirmation?order-confirmed=true ``` allows dynamic recovery of the gift card code. No limitation prevents automation of this process.
### Attack Automation (macro) To exploit the large-scale fault, a **macro Burp Suite** is implemented.
#### Requests Intercepted in the Macro 1. Add a product **Gift card** to the basket 2. Application of the newsletter coupon (`SIGNUP30`) 3. Order validation (`place order`) 4. Recovery of order confirmation response 5. Registration of gift card on user account
#### Key Macro Points * The **gift card code** is extracted dynamically from the `cart/order-confirmation` response.
* This code is then reinjected by POST request to the Gift Card Management Endpoint. * A custom **parameter** is set in the GET query to store the code value.
The applied coupon recovers its value from a previous query, allowing for automatic re-use.
### Mass Execution Once the macro is configured: All requests for the **URL scope** automatically trigger the macro. * A **Intruder** query is sent to the site root. * Configuration: * **500 requests** * **Payload null**
**Resource pool** limited to **1 concurrent request**
This approach makes it possible to chain purchases, confirmations and credits of gift cards without interruption. #### Result The account balance increases indefinitely. / Once sufficient credit is accumulated, the purchase of the **Lightweight l33t leather jacket** becomes possible without financial constraint.
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/web/business-logic/logical-flaw-allowing-you-to-generate-infinite-money.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.