Portswigger - Business Logic - Lab #2 High level logic vulnerability

Hello Hackers, in this video of High level logic vulnerability you will see how to exploit, discover and find senstive information based on application logic flow to leak for potential attacks from Burp Suite in a lab from Web Security Academy powered by Portswigger ⚠️ Subscribe to my channel ➡️ @popo_hack ⚠️ 0:00 - About the Lab 0:37 - Mapping the application 1:54 - Test the purches workflow 4:03 - Test API endpoints 🔍 About the Lab Lab: High-level logic vulnerability Level: Apprentice This lab doesn&adequately validate user input. You can exploit a logic flaw in its purchasing workflow to buy items for an unintended price. To solve the lab, buy a "Lightweight l33t leather jacket". You can log in to your own account using the following credentials: wiener:peter ✅ What to do ? 1. With Burp running, log in and add a cheap item to your cart. 3. Go to the "Intercept" tab and turn on interception. Add another item to your cart and go to the intercepted POST /cart request in Burp. 4. Change the quantity parameter to an arbitrary integer, then forward any remaining requests. Observe that the quantity in the cart was successfully updated based on your input. 5. Repeat this process, but request a negative quantity this time. Check that this is successfully deducted from the cart quantity. 6. Request a suitable negative quantity to remove more units from the cart than it currently contains. Confirm that you have successfully forced the cart to contain a negative quantity...