ALERT!
Click here to register with a few steps and explore all our cool stuff we have to offer!

Jump to content



Photo

How to change Html / Javascript values?


  • Please log in to reply
How to change Html / Javascript values?

#1

OfficerDDoS
OfficerDDoS
    Offline
    124
    Rep
    293
    Likes

    Sheriff

Posts: 1162
Threads: 126
Joined: Nov 08, 2018
Credits: 0

Five years registered
#1

Hey guys, 

 

how can i change values like the prices on cheap old Websites in a purchase request? Sometimes its easy to change it a little bit if it looks like this 

Please Login or Register to see this Hidden Content

but on many sites they're more hidden. I mostly get 0 results if i search the whole code on the value i want to inspect. 


  • 0

 use lucas mm • use lucas mm • use lucas mm • use lucas mm • use lucas mm • use lucas mm •  use lucas mm • use lucas mm • use lucas mm • use lucas mm

 

officer_ddos_v2.png

 

use lucas mm • use lucas mm • use lucas mm • use lucas mm • use lucas mm • use lucas mm •  use lucas mm • use lucas mm • use lucas mm • use lucas mm


#2

OfficerDDoS
OfficerDDoS
    Offline
    124
    Rep
    293
    Likes

    Sheriff

Posts: 1162
Threads: 126
Joined: Nov 08, 2018
Credits: 0

Five years registered
#2

Any idea ? There is a Browseraddon where you can catch the request and just change the values but i forgot the name.


  • 0

 use lucas mm • use lucas mm • use lucas mm • use lucas mm • use lucas mm • use lucas mm •  use lucas mm • use lucas mm • use lucas mm • use lucas mm

 

officer_ddos_v2.png

 

use lucas mm • use lucas mm • use lucas mm • use lucas mm • use lucas mm • use lucas mm •  use lucas mm • use lucas mm • use lucas mm • use lucas mm


#3

Trees
Trees
    Offline
    46
    Rep
    12
    Likes

    Member

Posts: 35
Threads: 3
Joined: Jan 18, 2015
Credits: 0

Eight years registered
#3

This kind of exploit is a relic of the early-mid 2000s before server-side validation was EZ to do. With the various payment frameworks, APIs, and additional offerings available today, no one is coding these kind of things by hand anymore.

 

The exact way this worked is based on how the payment system(s) conducted transactions, also due to bad configuration of buttons (think the old PayPal dono buttons). When a transaction went through for a specific item, the price wasn't taken into account, i.e. you could literally pay $0.01. And also this method usually involved instantly-available pay-to-download content like Videos, Audio/Music, Ebooks, etc, where the content needed to be available instantly.

 

Now-a-days, this is handled by multiple services communicating with each other through backend APIs to verify that the payment was completed, successful, and for the correct amount. At best, you will lose your money.

 

There are many tools that used to be used to do this. I believe the tool you are referring to was called TamperMonkey or TamperData or similar. You can try Fiddler or even just use inspect element (right click near element).


  • 1

kvMaaIu.png


#4

OfficerDDoS
OfficerDDoS
    Offline
    124
    Rep
    293
    Likes

    Sheriff

Posts: 1162
Threads: 126
Joined: Nov 08, 2018
Credits: 0

Five years registered
#4

This kind of exploit is a relic of the early-mid 2000s before server-side validation was EZ to do. With the various payment frameworks, APIs, and additional offerings available today, no one is coding these kind of things by hand anymore.

 

The exact way this worked is based on how the payment system(s) conducted transactions, also due to bad configuration of buttons (think the old PayPal dono buttons). When a transaction went through for a specific item, the price wasn't taken into account, i.e. you could literally pay $0.01. And also this method usually involved instantly-available pay-to-download content like Videos, Audio/Music, Ebooks, etc, where the content needed to be available instantly.

 

Now-a-days, this is handled by multiple services communicating with each other through backend APIs to verify that the payment was completed, successful, and for the correct amount. At best, you will lose your money.

 

There are many tools that used to be used to do this. I believe the tool you are referring to was called TamperMonkey or TamperData or similar. You can try Fiddler or even just use inspect element (right click near element).

 

It took me a while to read your post but man you helped me alot ^^. Ive usually just used "inspect Element" and tried to manipulate payment forms. But this works only for like 1% of the sites ive tested. Saw a yt video where IT Experts used a browser plugin or something to change the request and yea that could be tampermonkey ^^ not sure atm

 

but its good to know that this is just a super old method to configure payments on a website


  • 0

 use lucas mm • use lucas mm • use lucas mm • use lucas mm • use lucas mm • use lucas mm •  use lucas mm • use lucas mm • use lucas mm • use lucas mm

 

officer_ddos_v2.png

 

use lucas mm • use lucas mm • use lucas mm • use lucas mm • use lucas mm • use lucas mm •  use lucas mm • use lucas mm • use lucas mm • use lucas mm



 Users browsing this thread: