Shulou(Shulou.com)05/31 Report--

How to use a penny to buy VPS services and web space, I believe that many inexperienced people do not know what to do, so this article summarizes the causes of the problem and solutions, through this article I hope you can solve this problem.

The Writeup shared today is that the author discovered the payment loophole between VPS and site hosting service providers, and purchased VPS and webspace services through an one-cent ($0.01) transaction.

Vulnerability situation

Two websites with loopholes

1. Redaced.net (a VPS service website)

2. Redaced.com (hosting service of a certain station)

One day, I wanted to buy a VPS service for network detection, so I opened the VPS service redacted.net, and I saw that there was a Paypal settlement option "Paypal Checkout" in its purchase. In general, online payment services send POST data requests to Paypal (/ cgi-bin/webscr), including the amount to be paid. Of course, if the Paypal payment Gateway (Braintrees Payments) during the transaction is not set up with reasonable data filtering / verification / measures, then the attacker can modify the amount to be paid and other related data.

For example, here the redacted.net website contains request data similar to the following in the payment request submitted by the user to Paypal:

... & amount=1321&tax=12&... .

Then I found this packet and made some modifications to it, as follows:

... & amount=0.01&tax=0&... .

In other words, I submitted the payment for a penny, and then I received a confirmation email from redacted.net:

After clicking on the "Confirm My Payment" payment confirmation, the VPS service I purchased was paid successfully!

The second is in a site hosting service website, when I buy its website space service with virtual currency, I find that it only tests the validity of Trx ID (TRONIX pay ID) in the course of the transaction, and does not verify the actual amount to be paid, so I successfully bought the website space worth almost 1.226.954 Indonesian rupees (equivalent to $90Mutual 95) with the above method at a price of one cent.

After reading the above, have you learned how to buy VPS services and web space for a penny? If you want to learn more skills or want to know more about it, you are welcome to follow the industry information channel, thank you for reading!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.