Friday, July 15, 2011

Hacking Online Shopping Carts and online survey sites- A HackingAlert exclusive!!




DISCLAIMER : I , ABHINAV SINGH DID NOT BREACH INTO THE SECURITY MEASURE OF THE FOLLOWING WEBSITES : IBIBO.COM , AVISOMART.COM,FLIPKART.COM .
I ONLY TESTED THEIR SECURITY MEASURES. THE AUTHOR IS IN NO WAY RESPONSIBLE TO ANY DAMAGE. tHIS ARTICLE IS ONLY FOR EDUCATIONAL PURPOSE.


There are a lot of shopping portals and websites picking up pace in India right now. But they are still not receiving the type of response they should be getting . American and European online shopping giants are among the  leading web companies currently but the scenario is different in India . People here are still stuck to the believe that they do not provide quality goods. They are only popular in metropolitan and big cities . 
The article is not about their popularity but their security . How secure are these websites and how secure is their payment gateway .
I went on to carry out my penetration testing on all popular online shopping websites. 
The point where all were strong was the payment gateway and the reason behind it was that the payment gateways are solely managed by the respective bank you are using for the transaction .
But what about the other security measures .
 Flipkart was all clear ,they are doing a good job in security measures I must say . But there were  some small flaws in other popular sites( I wont take the name) . I have reported this to the admins about the flaws and got response too. I was fortunate enough this time , but I am  still waiting for the response from my previous exposure of security flaws in Dhoni's , Priyanka chopra's and Priety Zinta's official websites.
I wont go into very detail of various penetration testing I applied on these online shopping websites but the front where I found these website vulnerable is analysing the HTTP headers.  







Consider these two images and note the price of Blackberry phone in my shopping cart . In top image it is 12,100.00 Rs and in the lower image its 121.00Rs . So how do you think the deal is!! Blackberry at Rs 121 only.

No I am not kidding . Infact as i proceeded to the payment gateway still it didnot make a final check weather i have modified the headers or not . It simply allowed me to buy this phone at Rs 121 only . 
By simply intercepting and working and analyzing closely the HTTP request and response that was transmitted during my penentration testing , I could figure out mechanisms to break them . 
Web developers hardly try to keep a check on the values that an authenticated user is sending . All they worry about is to make the authentication secure but in the mean time they forget how important is validating the request of an authenticated user as well. You wont find such security flaws in any top online shopping websites of America or Europe. 

Here I will also show how online survey websites can also be tricked upon to increase your survey money. 
Earning money through online survey is currently very popular in India but they are currently the most vulnerable systems online. I have an account on a survey website too. I simply hacked it to increase my earnings without even submitting my survey . Also I went on a step further to hack the servers to add free 100$ payment point in my account and even successfully transfered it to other account .





I do not understand why the hell these websites impliment captcha and other security measures when they have even bigger threats than spam open to be breached. 

Anyways the issues have been patched in most of the websites I have reported about.
Atleast these companies are not completely ignorrant like our government agencies who have so many loopholes still opened thatswhy I never posted any information about them as It can be a matter of National security. 
I still suggest to all my readers and friends that we are in a world that is largely goverened by the web so we must contribute to make it a better and healthier place . We cannot be evils and destroy the wonderful creation of mankind. Developers , coders , companies put in lot of effort to bring services at the click of fingers for its users but some Dark Hackers try and exploit the weak areas and disturb the whole service. Instead the should work actively to build a better web . You know what inspires me the most these days?? The new add campaign of Google crome - "THE WEB IS WHAT YOU MAKE OUT OF IT" .
Its simply very true. Thanks for reading . Please add your valuable comments for improvements and suggestions.


DARKLORD!!



44 comments:

  1. sir how to use dis webscarab......

    ReplyDelete
  2. hey read this post to know about using webscarab http://hackingalert.blogspot.com/2011/07/intercepting-http-requestresponse-using.html

    ReplyDelete
  3. yar wese ap har cheez ka method bta dete ho magr ap ne above mentioned articals ka method ne bataya :( :(

    ReplyDelete
  4. @shahbaz : i did this by hacking HTTP request/response..you can check out my post on using web scarab to hack online applications...the process is quiet same :)

    ReplyDelete
  5. For more tricks visit
    http://www.hackerzmiracle.tk , http://darklord-emailhacking.blogspot.com
    its also a gud site..thanks..comment and follow if u like..thanks once again and pls do me a favour please send me the site review..
    Email- darklord.aman@gmail.com

    ReplyDelete
  6. Useful information like this, I will put this one on my bookmark list! Thanks for this wonderful post and hoping to post more of this!

    Best Online Survey Software

    ReplyDelete
  7. Hey, it wil change the amount in displaying page only but while on payment it requires the original rate, how to hack the amount on netbanking or credit card payment

    ReplyDelete
  8. Hey See it here.....
    http://hackersmob.webs.com/

    ReplyDelete
  9. This comment has been removed by the author.

    ReplyDelete
  10. i read your post and its very interesting.. can i ask if you can make a hack on these secured website?? http://www.rankedgaming.com/shop/

    you can use this account

    username: skabern
    password: sgtskabern

    i would be happy if you can hack that website! thanks.. please pm me if you are successfull! i will bow down to you! ^^ thanks! email me if you want skabern@gmail.com

    ReplyDelete
  11. Hai

    I would like to share FNP coupons

    Coupon code: FLOWERAN15

    Flat 15% discount on any purchase.

    ReplyDelete
  12. Hai

    I have found fnp coupons

    Coupon code: FLOWERAN15

    Flat 15% discount on any purchase.

    ReplyDelete
  13. Hai

    Visit www.lovelyoffers.com for all the deals and discount coupons.

    lovelyoffers.com is the India's No.1 coupon site.

    ReplyDelete
  14. Hai

    Visit www.lovelyoffers.com for all the deals and discount coupons.

    lovelyoffers.com is the India's No.1 coupon site.

    ReplyDelete
  15. Hai

    Use these coupon codes of FernsNPetals.com

    Coupon code: LOVELYOFER

    Get special discount of upto 15% on any order

    Coupon code: BESTFNPS15

    Get an Extra 15% Discount on any order @FNP.com

    offer Valid upto 31st May 2014

    ReplyDelete
  16. Hai

    I would like to share Myflowertree coupons

    Coupon code: BP15

    15% Flat off across website MyFlowerTree.com

    Coupon code: BPROSES

    Get Roses Free with Every Order on Cake

    ReplyDelete
  17. Hai

    Enjoy 10% discount on any purchase across the website.

    Coupon code: PWMDOFFER10

    Validity: 25/05/2014

    ReplyDelete
  18. Hai

    I would like to share Myflowertree coupons

    Coupon code: BP15

    15% Flat off across website MyFlowerTree.com

    Coupon code: BPROSES

    Get Roses Free with Every Order on Cake

    ReplyDelete
  19. Hai

    I would like to share Myflowertree coupons

    Coupon code: BP15

    15% Flat off across website MyFlowerTree.com

    Coupon code: BPROSES

    Get Roses Free with Every Order on Cake

    ReplyDelete
  20. Hai

    Use this 100bestbuy.com coupon

    Enjoy Rs.100 discount on any purchase across the website

    Coupon code: BPC100

    Validity: Lifetime

    ReplyDelete
  21. Hai

    get disscount on bus tickets

    Coupon code: ETSBESTPROMO12

    Get up to 12% or Maximum of 100/- Discount,
    which ever is less per passenger on bus tickets.

    Validity: 31st May, 2014.

    ReplyDelete
  22. Hai

    Use this 100bestbuy.com coupon

    Enjoy Rs.100 discount on any purchase across the website

    Coupon code: BPC100

    Validity: Lifetime

    ReplyDelete
  23. Hai

    I would like to share Myflowertree coupons

    Coupon code: BP15

    15% Flat off across website MyFlowerTree.com

    Coupon code: BPROSES

    Get Roses Free with Every Order on Cake

    ReplyDelete
  24. Hai

    Enjoy 10% discount on any purchase across the website.

    Coupon code: PWMDOFFER10

    Validity: 31/12/2014

    ReplyDelete
  25. Hai

    Use these coupon codes for Exiting offers

    Coupon code: BMFBEST15

    Flat 15% off @ minimum purchase of 399

    Coupon code: BMFBESTC15

    Flat Rs. 100 off in Cakes @ No minimum purchase

    http://www.bookmyflowers.com/cakes-1-16-t.html

    Coupon code: BMFBEST100

    Flat Rs. 100 off @ Minimum purchase of Rs. 599

    ReplyDelete
  26. Hai

    I would like to share Myflowertree coupons

    Coupon code: BP15

    15% Flat off across website MyFlowerTree.com

    Coupon code: BPROSES

    Get Roses Free with Every Order on Cakes

    ReplyDelete
  27. Hai

    Use these coupon codes for Exiting offers

    Coupon code: BMFBEST15

    Flat 15% off @ minimum purchase of 399

    Coupon code: BMFBESTC15

    Flat Rs. 100 off in Cakes @ No minimum purchase

    http://www.bookmyflowers.com/cakes-1-16-t.html

    Coupon code: BMFBEST100

    Flat Rs. 100 off @ Minimum purchase of Rs. 599

    ReplyDelete
  28. Hai

    Use these coupon codes for Exiting offers

    Coupon code: BMFBEST15

    Flat 15% off @ minimum purchase of 399

    Coupon code: BMFBESTC15

    Flat Rs. 100 off in Cakes @ No minimum purchase

    http://www.bookmyflowers.com/cakes-1-16-t.html

    Coupon code: BMFBEST100

    Flat Rs. 100 off @ Minimum purchase of Rs. 599

    ReplyDelete
  29. Hai

    Use these coupon codes for Exiting offers

    Coupon code: BMFBEST15

    Flat 15% off @ minimum purchase of 399

    Coupon code: BMFBESTC15

    Flat Rs. 100 off in Cakes @ No minimum purchase

    http://www.bookmyflowers.com/cakes-1-16-t.html

    Coupon code: BMFBEST100

    Flat Rs. 100 off @ Minimum purchase of Rs. 599

    ReplyDelete
  30. Hai

    I would like to share Myflowertree coupons

    Coupon code: BP15

    15% Flat off across website MyFlowerTree.com

    Coupon code: BPROSES

    Get Roses Free with Every Order on Cake

    ReplyDelete
  31. Hai

    Use these coupon codes for Exiting offers

    Coupon code: BMFBEST15

    Flat 15% off @ minimum purchase of 399

    Coupon code: BMFBESTC15

    Flat Rs. 100 off in Cakes @ No minimum purchase

    http://www.bookmyflowers.com/cakes-1-16-t.html

    Coupon code: BMFBEST100

    Flat Rs. 100 off @ Minimum purchase of Rs. 599

    ReplyDelete
  32. Hi

    Exclusive Discount on Womens Clothing@StalkBuyLove.com

    Coupon code: SBLBPC100

    Get Rs.100 off any order,Not applicable on products in sales section

    Coupon code: SBLBPC250

    Get Rs.250 off any order above Rs.1500,Not applicable on products in sales section

    ReplyDelete
  33. Hai

    Use these coupon codes for Exiting offers @ Bookmyflowers.com

    Coupon code: BMFBEST15

    Flat 15% off @ minimum purchase of 399

    Coupon code: BMFBESTC15

    Flat Rs. 100 off in Cakes @ No minimum purchase

    http://www.bookmyflowers.com/cakes-1-16-t.html

    Coupon code: BMFBEST100

    Flat Rs. 100 off @ Minimum purchase of Rs. 599

    ReplyDelete
  34. Hai

    Use these coupon codes for Exiting offers @ Bookmyflowers.com

    Coupon code: BMFBEST15

    Flat 15% off @ minimum purchase of 399

    Coupon code: BMFBESTC15

    Flat Rs. 100 off in Cakes @ No minimum purchase

    http://www.bookmyflowers.com/cakes-1-16-t.html

    Coupon code: BMFBEST100

    Flat Rs. 100 off @ Minimum purchase of Rs. 599

    ReplyDelete
  35. Hai

    Enjoy 10% discount on any purchase @ Phoolwala.com

    Coupon code: PWMDOFFER10

    Validity: 31/12/2014

    ReplyDelete
  36. Hai

    Use these coupon codes of FernsNPetals.com

    Coupon code: LOVELYOFER

    Get special discount of upto 15% on any order

    Coupon code: BESTFNPS15

    Get an Extra 15% Discount on any order @FNP.com

    offer Valid till 31st Dec 2014

    ReplyDelete
  37. Hai

    Get discounts @FNP.com

    Coupon code: FNPWINNER1

    10% off @ No minimum purchase.

    Coupon code: FNPWINNER2

    15% off @ minimum purchase of Rs. 599.

    Coupon code: FNPWINNER3

    Flat Rs.50 off @ No minimum purchase.

    Coupon code: FNPWINNER4

    150 off @ minimum purchase of Rs. 899.

    ReplyDelete
  38. Hai

    Use these coupon codes for Exiting offers @ Bookmyflowers.com

    Coupon code: BMFBEST15

    Flat 15% off @ minimum purchase of 399

    Coupon code: BMFBESTC15

    Flat Rs. 100 off in Cakes @ No minimum purchase

    http://www.bookmyflowers.com/cakes-1-16-t.html

    Coupon code: BMFBEST100

    Flat Rs. 100 off @ Minimum purchase of Rs. 599

    ReplyDelete
  39. Hai

    I would like to share Myflowertree coupons

    Coupon code: BP15

    15% Flat off across website MyFlowerTree.com

    Coupon code: BPROSES

    Get Roses Free with Every Order on Cake

    ReplyDelete
  40. Hai

    Get discounts @FNP.com

    Coupon code: FNPWINNER1

    10% off @ No minimum purchase.

    Coupon code: FNPWINNER2

    15% off @ minimum purchase of Rs. 599.

    Coupon code: FNPWINNER3

    Flat Rs.50 off @ No minimum purchase.

    Coupon code: FNPWINNER4

    150 off @ minimum purchase of Rs. 899.

    ReplyDelete
  41. Hai

    Enjoy 10% discount on any purchase @ Phoolwala.com

    Coupon code: PWMDOFFER10

    Validity: 31/12/2014

    ReplyDelete
  42. Hai

    I would like to share Myflowertree coupons

    Coupon code: BP15

    15% Flat off across website MyFlowerTree.com

    Coupon code: BPROSES

    Get Roses Free with Every Order on Cake

    ReplyDelete
  43. Hai

    Use these coupon codes of FernsNPetals.com

    Coupon code: LOVELYOFER

    Get special discount of upto 15% on any order

    Coupon code: BESTFNPS15

    Get an Extra 15% Discount on any order @FNP.com

    offer Valid till 31st Dec 2014

    ReplyDelete
  44. Hai

    Use these coupon codes for Exiting offers @ Bookmyflowers.com

    Coupon code: BMFBEST15

    Flat 15% off @ minimum purchase of 399

    Coupon code: BMFBESTC15

    Flat Rs. 100 off in Cakes @ No minimum purchase

    http://www.bookmyflowers.com/cakes-1-16-t.html

    Coupon code: BMFBEST100

    Flat Rs. 100 off @ Minimum purchase of Rs. 599

    ReplyDelete