So here’s the plan: We’re going to set cpl to a negative value to confuse the game if this input isn’t validated. That leaves only one option - but how can we use the cpl variable to our advantage? Crafting a malicious request Attempting the first two potential exploits returns a Server Error response.

Adjust the cost per line to alter the slot machine’s financial calculationsįrom here, it’s a matter of trial and error.

Bet on more lines than actually exist on the slot machine.

Change the bet amount to a bigger stake than we can actually afford.

By tweaking these values, we might be able to: But what about that last line? betamount = 1 & numline = 20 & cpl = 0.1Ĭomparing these variable names to the GUI, we can ascertain that this is our browser telling the server how much we’re betting, the number of lines we’re betting on, and the cost per line. This is all pretty normal for this kind of request. We can see that the request provides some cookie information, details about the page we’re on and our user agent, and so on.

We can see that this is a POST request, which means that the client is transmitting information to the server ( ). This looks like a pretty standard web request. Here’s what is sent when we hit the Spin button… By using the Burp Suite proxy’s intercept function, we can hold requests and responses between the web browser and the server to give us time to review their contents and see what’s going on when we place a bet. Like any web application, the slot machine must be communicating with a server behind the scenes to make playing the game possible. Instead, let’s take under the hood to see what we can hack… Observing requests Since our objective is to hit more than 1,000 credit, we could just play the slots for a long time to try to get lucky.

Your credit is updated based on the outcome. You can choose various options before placing a bet by hitting the Spin button. It’s fairly typical for such games (at least as per my understanding following a short trip to Las Vegas for Black Hat and Def Con). Let’s follow the link and take a look at the slot machine. What does the Jack Frost Tower casino security team threaten to do when your coin total exceeds 1,000? Submit the string in the server data.response element. Test the security of Jack Frost’s slot machines. We’re given a link to an online slot machine and the following request: Here’s one more writeup from the SANS Holiday Hack Challenge! The slot machine hack was one of the showpiece challenges this year, so I thought I’d put together a quick blog post to guide you through the process of identifying and exploiting a vulnerability in the game.

Hacking casino slots