# The Bug That Kept On Giving :: PaymentBypass :: Response Manipulation

Client-side trust of payment response let attacker flip 'Refused' to 'Authorised' in Burp, obtaining e-giftcards without paying.

- Payout: $531 (paid EUR 500)
- Severity: high
- Program: -
- Credited: g30rgy th3 d4rk
- Disclosed: 2022-12-16
- Write-up quality: 6/10
- Original: https://crypt0g30rgy.github.io/post/PaymentBypassTwo
- Library page: https://bugbountylibrary.com/r/blog%3Acrypt0g30rgy-github-io-post-paymentbypasstwo
- Tags: domain:web impact:funds-loss kind:bounty platform:blog sev:high tech:payment technique:source-review vuln:business-logic vuln:fee-bypass

**Target:** e-giftcard checkout flow (POST /v1/Payment, /v1/HandleResponse)
**Root cause:** The frontend decides payment success from the server's response body ('Authorised'/'Refused') and then calls /v1/HandleResponse with that value, without server-side verification that the payment actually settled.
**Steps:**
1. Add item to cart at gifts.jij0.be and proceed to checkout
2. Fill details, choose pay with card, enter test card `1337 1337 1337 1337` exp `03/30`
3. Enable Burp intercept; capture `POST /v1/Payment`
4. Intercept the response, observe body data `Refused`
5. Change `Refused` to `Authorised` and forward
6. Disable intercept; client calls `POST /v1/HandleResponse` with `Authorised` and redirects to confirmation
**How found:** Read the makePayment JS and noticed the developer trusted the server response and used it directly for action comparison and dropin.setStatus, realizing Burp could rewrite that response.
**Exploitation:** Attacker intercepts the payment response in Burp, rewrites the status from Refused to Authorised, and the client-side JS treats the order as paid, calling HandleResponse and redirecting to the confirmation page, yielding a free e-giftcard.
**Insight:** When checkout JS branches on a response string like 'Authorised' and then posts that same value to a fulfillment endpoint, intercept the response and flip the value; the fulfillment endpoint trusting the client-supplied status is the real flaw.