Lab: Flawed enforcement of business rules

APPRENTICE

This lab has a logic flaw in its purchasing workflow. To solve the lab, exploit this flaw to buy a "Lightweight l33t leather jacket".

You can log in to your own account using the following credentials: wiener:peter

Access the lab

Solution

Log in and notice that there is a coupon code, NEWCUST5.
At the bottom of the page, sign up to the newsletter. You receive another coupon code, SIGNUP30.
Add the leather jacket to your cart.
Go to the checkout and apply both of the coupon codes to get a discount on your order.
Try applying the codes more than once. Notice that if you enter the same code twice in a row, it is rejected because the coupon has already been applied. However, if you alternate between the two codes, you can bypass this control.
Reuse the two codes enough times to reduce your order total to less than your remaining store credit. Complete the order to solve the lab.

Community solutions

Michael Sommer

Want to track your progress and have a more personalized learning experience? (It's free!)

Sign up Login

In this topic

Business logic vulnerabilities Examples of business logic vulnerabilities

Register for free to track your learning progress

The benefits of working through PortSwigger's Web Security Academy

Practise exploiting vulnerabilities on realistic targets.
Record your progression from Apprentice to Expert.
See where you rank in our Hall of Fame.

Already got an account? Login here