Step 1: Let’s order a pizza!
Register for Cheesy Does it and you’ll see the following page once you log in. You can build your own pizza, but for brevity, let’s add a pre-designed classic pizza and add it to cart:
Step 2: $12.99? Not too bad! Let’s check out!
Once your chosen pizza is in your cart, hit “Checkout”.
Step 3: Add details and place order
Simply add some fictional details and “Place Order”
Step 4: Wait for your pizza to be delivered
This is making me hungry! It’ll take a short while to get delivered. Meanwhile, fire up your proxy tool of choice e.g burpsuite, caido or zap.
Step 5: Despite it being delivered within a few mins, let’s say it was cold
Report a problem with your order and don’t forget to select the “Request refund” tick-box. Then ensure you’re capturing traffic and hit “Submit”
Step 6: This pizza shop is going to make me a millionaire!
The business logic here means you can request a refund….for whatever amount you choose. Yes that’s right. YOU get to to choose your own refund amount! Bought a $12.99 pizza? Well, you get a $1,000,000 refund! Send your refund request once you have chosen how much of a refund you want and you’ll get the flag in the response!
Thanks for reading! Subscribe for more.
