3 ms·

There were web stores in the early 90s where the price of an item was contained within a hidden form field and not verified when you added it to your cart, allo

There were web stores in the early 90s where the price of an item was contained within a hidden form field and not verified when you added it to your cart, allowing you to buy things for arbitrary prices, or sometimes zero.

InefficientRed 5y ago
Browser based games were another wild west. The basic move was to post something mildly controversial in your "profile page" -- which often used the MySpace style of "whatever HTML you want" -- along with a cookie logger. Then be obnoxius in chat/forums. Pretty soon, an admin would visit your profile to check out the offending content and ban your account. In the process, they would give you their admin cookie. I was a dev/admin for a few of these browser-based games and would also poke at other people's games, so I was saw both sides of the arms race. That wild west still exists in browser based games, which were labors of love with large enough user bases to keep the steam going but not commercially viable enough to justify any sort of actual investment. There are still a half dozen or so browser based games running on huge piles of PHP written by middle schoolers and high schoolers in the mid to late 2000s. Many still have XSS and SQL injections lurking in forgotten little corner features.
- joeframbach 5y ago
  The ones I vaguely remember are AlienAA and Outwar. I can't believe these are still running. I haven't even thought about them in almost 20 years.
philliphaydon 5y ago
Similar with early PayPal integration. I played a mmorpg for a while and figured out that when buying credits and they sent the request to PayPal it was a post. Using Firefox tamper data I would modify the request to submit $1 and on return set it to $20. Had a similar hack occur on a clients website at work. They sold flowers I think, and gift cards. But the max value was like $30 and we got gift cards for $100/$1000 but they only paid $1. I wasn’t invoked in that bug report but I suspect it was a similar issue. The good old days.
shepherdjerred 5y ago
My university's webstore has this exact flaw even today
TowerTall 5y ago
I gave my sister a very nice upgrade on her first internet connection 25 years ago when the order form with the ISP had that the same feature. You could change the speed on any plans they offered. Ordered the cheapest plan but changed the form hidden speed field to maximum. It worked perfectly for many years without us ever being contacted by the ISP regarding this.

InefficientRed 5y ago

Browser based games were another wild west. The basic move was to post something mildly controversial in your "profile page" -- which often used the MySpace style of "whatever HTML you want" -- along with a cookie logger. Then be obnoxius in chat/forums. Pretty soon, an admin would visit your profile to check out the offending content and ban your account. In the process, they would give you their admin cookie. I was a dev/admin for a few of these browser-based games and would also poke at other people's games, so I was saw both sides of the arms race. That wild west still exists in browser based games, which were labors of love with large enough user bases to keep the steam going but not commercially viable enough to justify any sort of actual investment. There are still a half dozen or so browser based games running on huge piles of PHP written by middle schoolers and high schoolers in the mid to late 2000s. Many still have XSS and SQL injections lurking in forgotten little corner features.

joeframbach 5y ago
The ones I vaguely remember are AlienAA and Outwar. I can't believe these are still running. I haven't even thought about them in almost 20 years.

philliphaydon 5y ago

Similar with early PayPal integration. I played a mmorpg for a while and figured out that when buying credits and they sent the request to PayPal it was a post. Using Firefox tamper data I would modify the request to submit $1 and on return set it to $20. Had a similar hack occur on a clients website at work. They sold flowers I think, and gift cards. But the max value was like $30 and we got gift cards for $100/$1000 but they only paid $1. I wasn’t invoked in that bug report but I suspect it was a similar issue. The good old days.

shepherdjerred 5y ago

My university's webstore has this exact flaw even today

TowerTall 5y ago

I gave my sister a very nice upgrade on her first internet connection 25 years ago when the order form with the ISP had that the same feature. You could change the speed on any plans they offered. Ordered the cheapest plan but changed the form hidden speed field to maximum. It worked perfectly for many years without us ever being contacted by the ISP regarding this.