myvector

What’s up bros? (by now I’ve gotta have at least two readers inshallah 🙂

Last week I told you about that $3000 unfair discount I found — the one they rejected like “yeah, couldn’t give less of a fuck” and dropped me back into the arms of informative, right from that exact spot. This week I’m raising the bar to God’s level. Gonna tell you how a real critical gets fucked. Man, this blog is filling up with insane losing stories and that’s beautiful lol.

Maybe My Own Country Will Pay Me Right

So bro, as you know, I’m Turkish. These days saying that might even be a crime in my goddamn country, don’t tell anyone ha😉 . Anyway, from the older posts you know the deal — I keep pulling valid findings out of top tier programs and keep eating informative, no good comes to me from these guys. So I’m thinking, maybe the bounty programs of my own beloved country will give me my due like real men? Or maybe they go, “oh, there’s this dude myvector, hmm, poked a hole in our system, poked it bad. Let’s hire this man right now.” My inner voice (gemini 😂 ) answers: Of course bro, he says. Nobody’s ever thought of this, genius idea. Go, he says, your worth is in the TR market, go get it bro. (fuck my inner voice 👌) I got another inner voice called claude but I’m not asking that bastard right now — the realist pimp will kill my mood for sure.

Cloudflare Won’t Let Me In: Burp vs Caido

So I get the itch and grab one of the biggest e-commerce sites in the country by the throat. Read the scope, add the header, all that. Then my burp handshake starts acting up. These guys’ number one priority in their whole bug bounty program is blocking burp, I swear.. Which is actually a hilariously effective move. If you can’t read the traffic behind it, you can’t change it, and if you can’t change it you can’t hack it😝 . Second I open Burp, cloudflare roars like a bear: hööyt, who are you, can’t let you in.. Like, what kind of nonsense is this, we didn’t even get in yet.. So I run to gemini, yo man, they won’t let me in, what’s the deal? It starts explaining — there’s the tls handshake… there’s the ja3 fingerprint… catching burp is easy anyway, blah blah. So I go, ok, and the result? Bro, use caido, it says? The fuck is that, I say? It goes: this — the best tool of a language called rust. Next-gen burp. Doesn’t fuck with your head, all pro pro, gives you two project slots even on the free version — and at that point… as a poor hacker, my eyes welled up. Switched lanes to caido on the spot. And our story begins..

Looking vs Seeing: A Week of Finding Nothing

Cloudflare, my man, went ohh welcome brother and opened the gates. Got into it with the wearehackerone alias. First I look around like always — signup, add address, add to cart, the usual, I watch the traffic of the known flow. Bro, I don’t understand shit. But that’s the standard rule anyway. First time on a system you just look; day by day you start to see. Noticing the difference between looking and seeing — that’s the whole thing. They call this awareness, but whatever, enough philosophy, keep playing. I analyze the js for a while. Me and that claude bastard write a python JS chunk analyzer called zındık. This guy’s better than gemini at that stuff. Though when it comes to banter, nobody beats gemini, ha. Good company, that pimp. Anyway, this zındık.py pulls every js off a target. Then greps and filters them. Makes a separate txt for each chunk. Looks for the basics — standard endpoints, apikeys, the usual.. For like a week I’m picking through this code. Nothing comes out, heheh — haddix, my man, shove the method you gave me 🤣

Anyway bro, then something happens — something always happens. By now I’m familiar with the system. I mean my eyes start biting the packets, and right then those things happen. But until the “thing” happens, here’s what’s rolling on the tape: we hit day 10. And I go, man, did I find these bugs by dumb luck or what? This dude inside me called imposter jumps in right away. Of course you did, motherfucker, what’d you think? And I usually believe him, bro. It’s a dumb voice, really — how many guys find 4 valid bugs in the world’s biggest companies? How is that imposter syndrome? But when that voice comes, you can’t help but think. Anyway — we’ll get there someday, maybe. The idea of comparing our Turkey market with the other markets comes to me. These guys serve in a bunch of different countries after all, so I wonder: what changes in the traffic, in the packets? Cookies change, bro — and everything starts after this. The first link of a chain, really.

The Frame From the Wrong Scene

I exit the TR market, switch to the neighbor. The switch happens from the homepage anyway, standard. And I start exploring. The language is similar too — I search for a product, add it to cart, everything’s allowed. Nice, even gave me a coupon, first-purchase special, that’s good too, and I move to the payment page..

I can’t move? It throws me back to my own TR cart. Allah Allah. Like — everything’s allowed in the neighbor store, but the second I hit buy you throw me to the TR cart, why? Bro, that’s exactly where I found the bug, turns out. That moment. That feeling. That “wait, there’s a glitch here” moment. Honestly, at that moment I had nothing in my hand — it’s only now, looking back, that the moment means something. At first glance the people who made the architecture decision would say: eh, your account’s TR.. your address is TR, why would we even take you to the neighbor’s payment page, right? It’s not like that, man — that’s the happy path in your head.. picture it like this. A frame should be followed by another frame, but that frame has to belong to that scene. But here it throws me to a frame from a previous scene?

So I look at it right away with caido. Zoomed into the frame, say. And here’s what I noticed, bro: the cookies were changing. The payment page was pulling me back to the TR cookie? Why does this system hold everything in cookies? Heh — good question. The assumption-breaking moment. So if it throws me to TR when I say “pay” from the neighbor, what happens inside if I re-inject the cookies right on this page? Bad things happened for these guys 🤣 — or at least that’s what I thought.

Breaking Price Integrity

First thing, I set these cookies on the payment page. And when I hit pay, I got an invisible ui error. Hmm — could this error be telling me something? The backend goes: my head’s spinning? You switched from the TR cart to another cart — ok, you can switch, I look at your cookie after all — but your address is TR? Eh, how does that work? Where am I gonna ship the thing? Between countries? So I go: easy, my man, calm down. I’ve got an address, maybe in that country, how would you know? Ohh, is that so, it says — then sure, you taking the amount from one cart and the product from another cart makes total sense 🤣

These are such fun moments, bro — just telling it feels good, heheh. Think about it — I’d almost broken price integrity on one of the biggest e-commerce sites in TR. One thing was left. Does “pay” actually work?

Gotta give credit here — me and that claude bastard are really going back and forth. Gemini’s out the door now… Why do I pick this guy? Because look, getting affirmed nonstop is boring. But what’s the AI gonna do, it’s trained that way. According to a Stanford study in Science I read today: AI affirms us 49% more than regular humans do. But in claude it’s lower. So it’s better for me anyway. Anyway, we’re passing the ball back and forth and a little debate breaks out between us — should we step into the payment stage or not. Like, was the proof enough or not, and then I go, fuck it. Hit the button. It’s gonna throw me to the 3d screen anyway. I don’t punch in the code — no need, the bank already saw it, done.. did it send with TL, or with the wrong price I saw in the ui? And boom — no joke — it slammed the price in a different currency straight to my bank, bros. So price integrity really broke, man. Because the system made a request to the outside now. So this is actually the top-level proof. I still think so. But my goddamn triager’s first question was gonna be “bro, what’s the order id 😏 “.. Anyway, I think I’ll throw that triager adventure into another part. Let this part be the technical side.

Why I Cut It Here

Now let me touch on why I cut it off so abruptly, and wrap up. Our man claude goes: brother, what did you even write, it got way too long, and you’re still going “I’ll keep writing” — stop, already. Because from here, you’d think the story’s basically over — nice clean ending, roll credits.. yeah, no.

Alternative ending: This TR e-commerce system bowed respectfully before myvector amid confetti and said, “what a guy you are, bro.” Right there it went, “give my man the $3000 critical reward, and have him come train our security team sometime”… That’s not how it went, bro 🤣

The next story is harsher and angrier.. so let’s not ruin the taste here. Next post, I’ll write about my merciless shootout with the triager and the new things I learned. Man — finding bugs is nice, but the process after writing the report? I’ll fuck that one. Namaste…🙏