Response Manipulation Lead To Premium Feature By Normal User Reward of $500

Introduction:

So let’s Start, I can’t disclose any information about the target yet, because the report is not disclosed but we can call it: redacted.com

was offering some features to subscribers to the site, One of These features include deleting annoying ads that appear on the site.

So I tried more than one extension that deletes ads, but they are not deleted

At this moment, I remembered this advice: “Always change in response from false to true you can find a magic.”

I said why don’t I search the response for anything that contains the word false and change it to true

So I searched for the word false and found a lot, but I focused on something related to advertisements and found {“areAdsDisabled”:false} In the response

I quickly went to Match and Replace in Burp suite and adjusted the settings as shown in the picture

and I refreshed the page

Guess what….

Now we can browse the site without ads as a premium user using a regular user, and this will certainly cause financial loss for the company in two ways.
1- first is that the company will not profit from the sponsored ads that appear on the site
2 — second is that the user will not have to pay for a subscription to remove ads