Intercept is on
Request
GET /level-8-zomatoctf/X-HackerOne: madguyyy

Level 8 – Hackoween II #ZomatoCTF

No such thing as free lunch?

14 Oct 2023CTFHackoween #ZomatoCTFWriteup~1 min read

No such thing as free lunch?

This level had Stripe implemented in demo mode (no real payments).

Goal is to make payment of ₹1 instead of ₹500.

On making the payment using given fake credit card details, it sent these values to CTF server
discount, amount, tip and quantity

Tried modifying the discount to 499. Didn’t work
Tried setting amount to 1. Didn’t work.
Tried setting tip to -499. WORKED and it revealed the flag.

Leave a message

// email is never published. name and email required