myvector

Hey hacı abi (for the non-Turkish readers, that’s street slang for “my wise homie”), what’s up?

Just here for a weekend stroll on my blog. Nobody reads it right now except me and an AI. Who knows, maybe you’ll wander in someday. It’s the law of large numbers, bro. A coin eventually evens out heads and tails. I’m betting on that probability. Trusting the universe, you know.

This post is about getting rich ($200 😭). I found a race condition in the system of those famous game-selling bros from the previous duplicate story. I didn’t get rich. But the disappointment literally made me sick. The human mind is weird, man. It can make you sick. Can it make you rich too? 🙂
I could say, “Our hero, duped again, said fuck this program and set sail.” But that’s too epic. Let’s stick to the basics.

After the dup disappointment, I moved to another program. But typical me. I asked, “Who’s the biggest badass around here?” and picked my new target. Sometimes I wonder. What if there was a simple twist? What if that last report wasn’t a dup? What if they tossed me 5 grand? Where would I be now? That question is poison, bro. It basically means: “Hey Universe, God, whatever… I know better than you. You messed up the laws of nature. If I ran things, it would be way better, hmph 🙁 hahah.” Look at that ego, wtf. What is, just is, man. It’s beyond good and evil. Somewhere out there in Rumi’s neighborhood. 🤣

Nobody’s reading anyway, let’s keep bullshitting. Wait, where’s the hack story? Dude, I never promised you a rose garden 😂. If you came for a pure technical writeup, I’m not your guy. I’m just here to observe a phase of my life. The “hacker vibe” is just a supporting role. Think of a guy reading life in 24 fps. He knows those frames aren’t actually moving. So what creates the motion? Perception. I’m just zooming in on the hack frame, right between perception and reality.

The Theory: Virtual Cards and Concurrent Requests

Anyway, let’s get into that frame. A race condition is basically an asynchronization story. If a backend fails to make things atomic, you have a shot. And my assumption was this. What security measures do companies sacrifice for their appetite for money?

The standard race scenario is: Can I buy two items for the price of one?
I asked myself, what’s the third option? (I’ll write about that someday too).
What if I order two different items with the same pricing tier at the exact same time? (Just a thought experiment).

Logically, the seller says: “I don’t care, are you stupid? You bought two items, I got my money, not my problem.”

But what if we add a virtual card limit? And the limit is exactly the price of one item? And I still push concurrent orders? What if these transactions are so fast the bank brain-farts? What if it approves both saying, “yeah man, there’s balance, send it”? Then it realizes, “oh shit, there isn’t.” Wakes up and slaps a “do not honor” on the 3rd request? We pushed two through. But we only have money for one. Where do we get the rest? What if the bank says, “Hold on, let’s check this guy’s linked main account”?
It did, bro… Let me tell you.

Executing the Attack: Legendary Mode

This target is an asset market. I saw my old friend in scope. I said, I don’t play games like a teenager. Let me check out AssetVault. It has a lot of credit on me anyway. Long story short, I poked around. The idea of triggering that flow popped into my head. I said, let’s try it, what do we lose? I’m a 33rd-degree black belt in parallel send anyway, wtf 🤣.

I listed the items. I don’t have cash in my pocket. I said dude, just hit the absolute cheapest. Then I checked the prices. Weird, there’s a tier system. Say a $1 item is 45 TL. It’s exactly 45.54 TL, down to the decimal. The next tier is, say, 123.24 TL. Hmm, these guys standardize prices. Finding items in the same pricing tier is super easy. It’s designed that way. Nice.

I moved multiple different items in the same pricing tier to checkout. My adrenaline is spiking. It’s my second race condition ever. And this is a massive badass market, no joke. That bastard Gemini keeps feeding me pessimism. “Fuck off, you think this is that hotel booking site? It’s Legendary 🤣 man, their name is literally Legendary wtf…” This is a kind of underdog psychology, by the way. If I took a course and followed a standard roadmap, I’d never touch Legendary. Why? Because this is a “here be dragons” story. Damn Fargo, that scene blew my mind hahah. There are notorious programs out there. If you mess with them, you supposedly need a blessing from Sheikh Haddix himself 🤣. Anyway, I didn’t get one. I was ignorant.

Multiple different items. Multiple concurrent tabs. Why multiple? Scientific method. Let’s say we hit two items and both passed. I couldn’t just say “I wonder if more would pass” and blow more test money. I ain’t got the cash 🤣. Jokes aside, bro. In an experiment, you need a control group for when something doesn’t happen. Otherwise, you don’t know why it happened. Anyway. Sent them to the concurrent request tooling, created the group, hit parallel send. Time slows down. How can 1-2 seconds feel so long?

The beautiful part:
First request… expected.
Concurrent request… holy shiiit!
A two approvals and one rejection pattern… Hmm. Come on man? For real?

The Panic: Wait, Did I Just Get Charged?

First thought: What does the race condition rulebook say? Bro, you bought two items for the price of one. Yippee. Dude we’re rich wtf. Maybe I found a High on Legendary. I can’t believe it..

Switch to the bank account immediately. Look and get even more shocked. Bro, the price for both items was withdrawn? Wait, how? Did the virtual card get pierced?
Yes bro, exactly that. And I get a severe feeling of collapse. Damn, there was no bug. The guys got their money. Gemini jumps in: “I told you man, it’s Lecındıri games… No joke 😂.”

But I’m an anomaly spotter. What business does a quitter have with hacking? I went blind with rage. Fuck it. There’s something else going on here. This time I explicitly set a deliberately constrained balance and took a screenshot. It’s such a state of idiocy, I’m doubting myself. Did I enter the limit wrong? Maybe I typed 160 instead of 60 and bought them both. I told myself, stop, calm down, start over.
Set a deliberately constrained balance. Take a screenshot. Find multiple different items. Wait, I already bought the previous ones, I need new items. Move them to multiple concurrent tabs. Enter the credit card. Turn on intercept, hit pay now. Catch it mid-air, send to concurrent request tooling. Group it up… Fire.
One approval, the rest rejected…
Are you fucking kidding me? Then I looked at the error messages. Bro, I entered the CVV wrong out of excitement puhahah.
There goes more test money. Wiped my sweaty hands on my pants. Like I said, I was seeing red. I’ll leave my whole salary on the table 🤣.

3, 2, 1… fire another batch… Boom!
A two approvals and one rejection pattern!
Whoa, again? And this time I am 100% sure the limit was low. Run to the bank. See two charges. Holy shit, they actually pierced the limit! After the extra cash was sucked from my main account—while the virtual card screamed “I couldn’t hold the line, boss!”—I was absolutely certain.
I’m rich wtf. Is it 10 grand or 20 grand now? That test money is a willing sacrifice to the Lecındıri crew 🤣. (Of course, I didn’t know how many more tests they’d make me do with ‘Need more info’, I’m just flying high hahah)

The HackerOne Waiting Game

Anyway, let’s get serious. (This story ends dramatically, but my stomach hurts from laughing right now hahaha).
First I went to that bastard Gemini. I said, “What happened dickhead? You said Lecındıri? You said it wouldn’t work.” Of course, they programmed this thing to say ‘yes’ to everything. So it started its bullshit. “Of course bro, I always trusted you… I knew you had it in you.” Shut the fuck up, I said. Cracked the whip. Write the damn report.
Man, it spat out a draft. I read it. The idiot didn’t even understand wtf. 🤣 It wrote, “We bought two items for a single fee.” The fucker can’t fathom they pierced the virtual card limit. It’s clipping my report. I shoved the virtual card receipts in its face. “Look man, can’t you see the receipts?” I said. Once it saw the exact same sequence number, it repented. And wrote the report 🤣.
Looking back, it’s hilarious. On one hand, “Dude we’re rich.” On the other, “Man, some bullshit is definitely gonna happen.” I waited 3-5 days like this. Dead silence. But I’m just beating up AIs.
“Man,” I say, “it’s an important bug, right?”
“Look dude, I forced a race condition on the banking system against Legendary,” I say.
“Of course they’re important, bro,” it says. “The bank is a huge deal. Chargeback lawsuits will destroy them. They’re gonna drop a High or Critical.”

I’m in such an echo chamber. If Kevin Mitnick showed up, I’d tell him “fuck off you lamer.” I was that hyped. 😂

But I want to call out the hack gods right here. Dude, you gave me the material to get so hyped. If you had just cut me off earlier, I wouldn’t have fallen this hard. I wouldn’t have had this much fun either. Whatever, I forgive you 😂.

First message from the triager: “While I can see evidence of the race condition…”
Try reading that and NOT getting hyped. Then I look at the rest: “Bro, there’s evidence. Sure. But if there was a video, and a step-by-step, it would be chef’s kiss.”

Right away, my guy. Here’s your video. Here’s your repro. CapCut is your bitch. Whatever you want. Our 20 grand is depositing soon, right?

Triager Mike gets back. “Bro, awesome evidence galore… But could it be more scalable? What’s stopping you at this limit, dude?”
Push a little more, 20 grand is on the way, huh.

My guy! Of course, let’s pull a high-volume stress test. A massive batch of concurrent requests side-by-side. Damn. 429s flying everywhere, but STILL a two approvals and one rejection pattern slips through. Even if the WAF steps in, it misses that overlap. What else do you want me to do, Mike?

Mike was finally convinced. But he said, “Bro, I can’t make the call here. I’m going to the internal team. You just wait, your money is on the way.” 🤣
Damn. Then I saw that “High to None” severity change in my email. My stomach cramped. I logged into HackerOne. Saw it as “Temporary.” I immediately summoned Gemini. Dude, I said, what the hell is happening? It said, “Bro, this is how the game is played. They don’t want to influence the internal team. The dev team makes the final call anyway. Just chill.” It managed to calm my nerves, bless its heart 🤣. Meanwhile, classes are still going on. Teaching HTML 101 at the whiteboard while waiting for news from Legendary… Those trigger moments were stressful as fuck, heheh.

Conclusion: Changing the Frequency

Anyway, I’ll tell the rest of the story next week. This part landed perfectly.

And bro, just write. Especially if you’re new to this. If you constantly feel “I am right wtf, everyone is against me”. Reading these steamrolled stories makes it all make sense. I’m not saying I’m wrong. But I’m talking about switching to a different FM frequency. Maybe from Doom & Gloom FM to Joy FM.
Anyway, let’s disperse peacefully. Next week. How the internal team and Gemini spoke the exact same language. (Deep down, neither was convinced it was a bug. The fucker was still saying ‘how is this a Race, we got two fees’ at the end 🤣. Could that bastard Gemini be a double agent? We’ll talk next week).

Peace out.