HPP Lab 2 - Signed Request Bypass


Bank Transfer Portal

This endpoint accepts a signed transfer request. The signature is computed over amount=1.

Can you transfer $9999 while only signing for $1?

Hint: Submit the form and inspect what happens when you duplicate the amount parameter in the POST body.






Hint (click to reveal)

Use Burp Suite to intercept the POST and add a second amount=9999 after the first. PHP will use the last value for the transfer, but the signature was computed for the first value.


Back to HPP Labs  |  More web challenges at RatCTF →  |  Get certified: Web App Pentesting (CxWAP) →