what is versai?
versai was an old minecraft bedrock practice server under the ip “versai.pro”. it was very popular during its prime. the target in this case was their store page; here you could buy custom ranks, cosmetics, or donate.
researching the server
for this attack, i focused on their payment processer - at the time they used a buggy fork of the popular processor stripe. while their processor was successful in accepting/rejecting purchases from legitimate cards with a check for invalid cards - they had one flaw; they left the testing mode toggleable on page load.
this was a while ago, around 2020-ish so i cant really remember the details well however if i created a purchase link, one of the post headers was testing=false
i simply looked at this and went, hmm what does this tell me?
stripe has public documentation on how testing mode works - this includes valid test cards that universally work on all stripe instances.
the “exploit”
to complete this, i forged a post request to create a new order whilst ensuring the testing=false header was set to true and my goodness it worked
i had a test payment page for xyz product right there, surely they had a check to distinguish between test payments and legitmate payments? right?
lol no they didnt. i put 111111111 or whatever the test card was and filled some fake details (name address etc) and the “payment” went through.
i was redirected back to the store page with “payment successful please relogin”
im sat here thinking “no way lmaoo”
i connect to the server and what do you know, the cosmetic i bought was right there.
i’ll hold my hands up and admit that yes i did abuse the hell out of this, buying $500 worth of in-game items for the high price of $0; i did eventually report this to them but their ego was too big i suppose and all they did was ban me from the server and shut the curtains on the situation.
so to bring awareness on how serious this flaw was, i created a donation link; yes again through stripe.
and after donating $40,000,000 to versai; the store was freaking out and it posted me on the store page as the highest donation. and that action was what caused them to realise, “huh maybe we shouldnt use a custom stripe version that hasnt been updated since the dinosaurs” and they eventually got off their high horse and updated.
they didnt remove my donation for like a month tho which was funny
but yes moral of the story; update your backend services. please. you cant expect to use software from 5 years ago without any consideration that there may be identified flaws/vulns with your system.