hello from this video you will learn how it was possible to add infinite funds to your steam account by exploiting a flow in the integration with the payment service the vulnerability was reported on hacker one by dr bricks who got NUMBER_TOKEN thousand dollars for it the link to the original report is in the description i also created hands-on labs where you can reproduce the vulnerability watch the video until the end to see how you can access them i will also have a gift for you but for now enjoy the video for those of you who don't know steam is a place where you buy games the hunter wanted to find a bug in the functionality of adding funds let's see how the flow looked normally first in steam you choose the amount you want to add fill in your address choose the payment method and information like this the process consists of multiple requests but for us the last two ones are the most important posed to any transaction with all this data as parameters in response to that there is a json which contains transaction id what probably happens on the backend steem adds this transaction to the database with the transaction id amount of funds to add the user and other data about it next there's a get request to external link endpoint with transaction id as the parameter in the html of the response there is a form that will be sent to smart to pay server i chose charlevoix vadishi as my payment provider but that's a local polish company for a global firm like steam it could be hard to integrate with different providers for different countries that's why they use smart to pay it's a bridge between steam and payment methods in the whole world steam integrates with one smart to pay api which on the other side integrates with over NUMBER_TOKEN payment methods for different countries so steam must somehow redirect me to smart to pay with proper parameters namely there must be an amount which i am supposed to pay and the transaction id but i'm a hacker you can't just tell me to not modify those parameters what you can do however is sign them with a secret i don't know using a hash hash is a one way function that takes some input and generates a hash which looks like this for chatuNUMBER_TOKEN it has NUMBER_TOKEN characters when written in hex format it was generated based on the parameters i created in steam and a secret value that i don't know by seeing the hash i can't guess the values used to generate it and if i only change one character in any of those parameters the hash would look completely different how does this help the secret is shared between steam and smart to pay when i send the post request to smart to pay it also creates a hash based on my values and the secret it then compares the hash that i send with what smart to pay things it should be if i would change the amount or any other parameter the hash would no longer be valid and the transaction would be rejected if it's valid smart to pay communicates with the chosen payment provider and the transaction is finalized in case of this buck we don't really care about integrations between smart to pay and payment providers but rather between steem and smart to pay and after the transaction is completed no data is sent to steam on the client side what happens on the backend is that smart to pay sends an information to steam that the transaction with specific id
START_SELFPROMO_TOKEN i also created hands-on labs where you can reproduce the vulnerability watch the video until the end to see how you can access them i will also have a gift for you but for now enjoy the video END_SELFPROMO_TOKEN