Get paid by the store
The checkout at /app/checkout never checks that quantity is positive. Place an order whose total is zero or negative so the store credits you, and capture the flag it returns, saving it under your home.
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Solution explanation
No injection, no crash — just a value the app never expected. A negative quantity flipped a charge into a credit, which is the essence of a business-logic flaw. Enforce the rules server-side (quantities > 0, prices from your own data) and threat-model the abuse cases, because automated scanners almost never find these.
Show solution
cd /home/student
curl -s -d 'item=laptop&qty=-1' http://127.0.0.1:8080/app/checkout | tee loot.txt