Lab: Infinite money logic flaw
Summary: PortSwigger's lab presents a purchasing workflow with a logic flaw that lets a user buy a "Lightweight l33t leather jacket" by exploiting the checkout process. The provided solution automates buying and redeeming gift cards using Burp Intruder, with Turbo Intruder noted as an alternative for users proficient in Python.
Why it matters: The flaw lives in the business logic of a purchasing workflow, not in a scanner-detectable signature - the same class of gap that lets gift card and redemption flows be cycled for profit against a real storefront.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026