Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Lab: Infinite money logic flaw

btc | Last updated: Jul 28, 2021 10:46AM UTC

In the Macro Editor, click "Test macro". Look at the response to GET /cart/order-confirmation?order-confirmation=true and note the gift card code that was generated. Look at the POST /gift-card request. Make sure that the gift-card parameter matches and confirm that it received a 302 response. Keep clicking "OK" until you get back to the main Burp window. 302 requests are shown here, but after the test macro, it gives 400 bad request errors and there is no lab.

Uthman, PortSwigger Agent | Last updated: Jul 29, 2021 10:59AM UTC