A business logic error bug worth 600$

Hey all,

Deep Patidar here, i hope all are doing good with good health. I am sharing my recent finding on hackerone private program, as terms and conditions i can not disclose the name of the program so call as target.com

lets say target.com has a functionality of refer a friend and if user will sign up and will activate paid plan, i will get 30$ as gift which referral code used by any other user while signup.

i was thinking like how can i use this functionality and abuse it. i thought lets check every request and try to manipulate price but there was server side validation so i didn’t get anything and like i can’t find

Photo by Jason Strull on Unsplash

After sometime i thought that let me use referral code with new signup

Step to reproduce:

  1. logged in my account and went to billing tab there was option for refer a friend
  2. I used this URL for new signup with referral link but nothing got as if user will activate their paid plan then only i will receive 30$ for each new registration
  3. I used this referral link for signup with new account and i activated paid plan as i had to pay 15$ for a month.

Now i logged in again in my account and checked wallet balance there was 30$ as i received because i shared my referral link to user for new signup.

Now its time to ask for refund so logged in new signed up account and submit a request for refund on cancel the subscription and in few hour i have a response on my ticket “we have canceled your subscription and refund already generated ”

Again i logged in with my account as checked that 30$ what i received for referral signup is there or not and i was like

Photo by bruce mars on Unsplash

Repeated this steps 3 times and now i have 90$ in wallet without getting paid anything, On the program if i will manage to get 300$ using same techniques i can make for 12 month premium subscription

Thank you for reading and have a great day ahead

Report Submitted — 13 Nov 2021

Triaged — 16 Nov 2021

Bounty paid — 600$ (17 Nov 2021)




A Network Security Engineer, Penetration Tester

Love podcasts or audiobooks? Learn on the go with our new app.

Recommended from Medium

{UPDATE} Drize Cars 2 Hack Free Resources Generator

How do I setup a Linksys router’s password?

Musings on Modern Data Security

Fractal Protocol Testnet Launch

Discord, Web3 Community and Security — love hate triangle

A GDPR refresher — the basics to remember as education goes virtual

netherlands driver license Psd Template


Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
Deep Patidar

Deep Patidar

A Network Security Engineer, Penetration Tester

More from Medium

My First Bounty and How Did I Get It?

How I was able to buy a product for free — $$$

The Password Bypass Leads to Full-Account-Takeover