Bypassing Promo Code Validation via Response Manipulation Enabled the Creation of a Business…

What is response manipulation?

Response manipulation involves intercepting and altering the server’s response to a client request in order to modify the application’s behavior. By changing data such as status codes or error messages, an attacker can bypass security checks, gain unauthorized access, or manipulate functionality to achieve unintended outcomes. This technique is often used in penetration testing to exploit vulnerabilities in web applications.

Explanation

Since the bug is not yet resolved and it’s a private bug bounty program, I will refer to the platform as example.com. Let’s now explain the functionality behind creating a business account.

While creating a normal account, I encountered a registration form that allowed me to create a business account using a valid email and password.

The form then required additional information to complete the registration, including First Name, Last Name, and Phone Number.

After clicking Continue, it asked for Company Name, Number of Employees, and a promo code.

However, it checked the promo code’s validity, and I had no idea how to submit a valid one. I thought it might be related to the company name, but that was also invalid.

So, I decided to intercept the request, and here’s what I found:

I sent it to the repeater and noticed that the response included an Invalid promo codemessage in JSON format, as shown below:

I thought about manipulating the response to bypass the error. I intercepted the request, selected Do Intercept, and choose Response to this request. Then, I modified the response as follows:

Oops, I successfully bypassed it and created the account.