3 ms·
naive question: is this all possible because there is no real server side validation of the entire transaction ? This seems a very basic architectural overlook,
by snickmy 3y ago
naive question: is this all possible because there is no real server side validation of the entire transaction ? This seems a very basic architectural overlook, or am I missing something ?
- nurettin 3y agoSecond try gets stopped by the server side validation. Third try was to overflow the integer, for which there was no check on the client or the server side.
- seritools 3y agoYou missed that they engineered the request so that the validation on the server side also overflows in the same way, thereby passing validation.