Horas..!!

Archive

Modifying Paypal Values on Lowlevel Web's

Sensitive Directory File-1 Sensitive Directory File-2 Shell Dork Advisories and Vulnerabilities-1 Advisories and Vulnerabilities-2 Vectors in C++ Visual Basic Irc Bot Make a Basic Batch Viruses How To Hack a Website (SUPER noobified) PHP Injection - Access Server Modifying Paypal Values on Lowlevel Web's Wireless Hacking Tracking Down a Botnet File of Password Page of Network Data Various Online Devices Vulnerable Servers Error Messages File of Important Information Page of Login Portals Analyzing a Trac SPAM Attempt Knock, Knock, Knockin' on EnGarde's Door (with FWKNOP) RPM and a perl.req Heredoc Bug HowTo: Secure your Ubuntu Apache Web Server :)~~~ Automatically Report all SSH Brute Force Attacks to ISPs <-- ???? :( Website Editing from the Perl Command Line <--wooowww ...... :) SSH Tunnel; HowTo <-- great job's :D Mitigating DNS Cache Poisoning Attacks with iptables Single Packet Authorization with Port Randomization How to write a port scanner in C Server Security <-- hehehehe..... :P Xss (Cross site scripting)  PuttyHijack V1.0 - Hijack SSH/PuTTY Connections on Windows  Pass-The-Hash Toolkit v1.4 Released for Download  SIPcrack - SIP Login Dumper & Hash/Password Cracker  Angry IP Scanner - Cross Platform Port Scanner Advanced SPA with fwknop Profiling psad with Devel::DProf Connecting to Mysql - PHP <-- jo2 Free Software Mapper and Cracker Tools Bot Search by Lateral Exploit from NewOrder and SecurityVulns ru

Modifying Paypal Values on Lowlevel Web's


Disclaimer:I take no responsibility for you or your actions from reading this. This is for educational purposes. This is illegal, so don't do it.

Among hacking and exploration I recently started playing a mmorpg game (World of Warcraft). The game uses virtual currency to allow players to buy new items. Chineese websites exist that sell the fake currency for USD.

After finding such a site I selected how much currency I wanted and was at the checkout paying with paypal when I looked the the source of the paypals "buy now" button

https://www.paypal.com/cgi-bin/webscr?on1=Character&currency_code=USD&cmd=_xclick&business=xxxxxxx_xxx@yahoo.com&on0=Character(Orders_Num)&amount=50.04&item_name=Orders_Num%3A+ /1108643&os1=&x=28&y=21

Right in the source was variable amount with the value 50.04 That was the price for the currency amount I selected to buy. The variable item_name had my order number:1108643 which had all the details like

how much virtual currency I was getting, my players name, etc. I changed the variable amount from 50.04 to 1.00 then put the url in firefox and continued the transaction on paypal. I changed the price from $50 to $1 and paypal accepted everything without a problem.

I then checked my player in the game and I had recieved what I was supposed to pay $50 for. I had altered the price and got away with it. After having proof this worked I contacted the owner of the website and repayed them $49.


I decided to test my new discovery on another website. The website sold music cds, I added a cd to my cart and checked out. When the paypal button was displayed on the page I checked the source:

scripts begin here --> <form action="https://www.paypal.com/cgi-bin/webscr" method="post" id="form1" name="form1">

<input TYPE="hidden" NAME="cmd" VALUE="_ext-enter">

<input TYPE="hidden" NAME="redirect_cmd" VALUE="_xclick">

<input type="hidden" name="receiver_email" value="xxxxxxx@xxxxxxxxxxx.com">

<input type="hidden" name="business" value="xxxxxxx@xxxxxxxxxxx.com">

<input type="hidden" name="item_name" value="CD xxxxxxx Order Number 13413300">

<input type="hidden" name="item_number" value="13413300">

<input type="hidden" name="amount" value="$17.73">

<input TYPE="hidden" NAME="first_name" VALUE="John">

<input TYPE="hidden" NAME="last_name" VALUE="Doe>

<input TYPE="hidden" NAME="address1" VALUE="1234 w. millerstreet">

<input TYPE="hidden" NAME="address2" VALUE="">

<input TYPE="hidden" NAME="city" VALUE="millerville">

<input TYPE="hidden" NAME="email" VALUE="JohnDoe@microsoft.com">

<input TYPE="hidden" NAME="state" VALUE="MV">

<input TYPE="hidden" NAME="zip" VALUE="12345">

<input type="hidden" name="image_url" value="https://www.xxxxxxxxx.com/graphics/logos/cdu_150_50.gif">

<input type="hidden" name="return" value="http://www.xxxxxxxxx.com/checkout/orderinfo.asp?option=completedpaypal">

<input type="hidden" name="cancel_return" value="http://www.xxxxxxxxx.com/checkout/orderinfo.asp?option=cancelledpaypal&amp;o=13413300&amp;c=10989249726714">

<input type="hidden" name="no_note" value="1">

<input type="hidden" name="currency_code" value="USD">

<input type="image" src="https://www.xxxxxxxxx.com/graphics/paypal.gif" border="0" name="submit" alt="Complete Your Order with a payments from PayPal - it's fast, free and secure!" width="150" height="52">

</form> <-- scripts end here

I changed the amount value from $17.73 to $1.00 and sent the POST. I was then at a paypal page saying: confirm order: xxxxxx price: $1.00

From there I knew it worked. Wether the person at the cd store would print the invoice and ship it OR contact FBI is beyond me.

I have now shown a simple method to modifying prices on items that are sold with paypal. Please don't get arrested, I take no responsibility for your actions. Hope you enjoyed my first article.

by focus