I'm a script kiddie with only the most basic JS and Python knowledge. I came upon an online contest by a food company where you had to submit pictures of yours

I'm a script kiddie with only the most basic JS and Python knowledge. I came upon an online contest by a food company where you had to submit pictures of yourself cooking with your kids using their products. People could then vote on the submissions (one vote per day / cookie) and the top 10 would win travel vouchers of between 500 to 5000 bucks value. I found out they'd done that before in other countries where apparently you had to submit videos, because there were tons of them on YT. I then used screenshots from those videos to make fake submissions. Then I found the url to cast votes, put them in a script within a legit advertising banner from a marketing campaign my company was currently running (I guess that's XSS?). I knew how many ad impressions each banner was to receive, so it would cast a vote only every 2k impressions or so. I ended up making off with about 4 grand. I'm only partly ashamed because: The call to cast votes would also return the current vote count. So I'd cast a vote for each submission once a day and put it in a db in order to monitor the current rankings. Turns out there was another guy whose votes would go up by exactly 100 a day, so it was either him or me taking home the money. I did this sort of stuff a couple times back when these exploits were more commonly possible (marketing people and their devs seem to have learned) and every single time there would be someone else who was also cheating. So really it was a hacker vs hacker (or rather kiddie vs kiddie) sort of battle rather than taking from the legit players.