Probably the hackiest "bypasses" I've ever pulled off in botting:
The Shopify REST API was for a long time the best and fastest way to checkout on Shopify. High rate limits, no captchas, no checkpoint and easy to work with. This is what gave Cyber the edge at the very start in 2018 (Dashe days)
The Shopify team (with @jmwind at the helm) spent years plugging the holes to make sure it wasn't used during drops.
Around 2020, Shopify released Shopify Pay, which allowed you to expedite checkouts on all stores by linking your details to a phone number. Turned out the payment tokens generated through there allowed you to use the payments API as you could 2 years back.
We generated around 3k Shop Pay accounts with randomised details, load balanced them across Cyber tasks (as rate limits were per account) and dominated every single release (...until it got patched).
We called it Fast2.
3 years later I noticed that the payments API could still be used with Shopify mobile apps using Apple Pay. Turns out you could still send the users' tokenised credit card data in the request and that would take precedence - and as long as a valid signed Apple Pay token generated in the last 2 minutes was also in the request data, the payment request would go through and bypass captcha and checkpoint.
Generating those Apple Pay tokens was the challenge, and reversing iOS frameworks was not an option. So I repurposed an old iPhone with a custom sideloaded Apple Pay app that would submit the token to our servers when the flow completed. And by combining accessibility macros, developer sandbox mode to prevent using real credit cards, a voice activation trigger and a old pair of earphones taped onto the microphone - a makeshift Apple Pay token server was born and Fast2 (or was it Fast3?) was back.
@jmwind thank you for providing me with the longest, most multi faceted puzzle ever.
56
51
1,553
246,983
Wouldn't be a sneaker Twitter resurrection without a good old Cyber Arcade style drop...
RESTOCK LIVE @ snake.cybersole.io/
First few to beat the game get a 14 days free trial.
39
5
261
67,831
Honestly what a time. And it's crazy to me that reselling is still profitable to this day... Still remember the days when we were using open source PHP scripts to generate Adidas ATC links...
This scene has taught me more than any master degree or corporate job possibly could. We were building and iterating faster than the engineering teams of the brands we were botting and the companies responsible for their infrastructure - at a fraction of the team size.
Nothing will beat the rush of deploying a last minute update to thousands of users or being the only bot hitting a drop.
The sheer amount of ingenuity required from devs of this community to find ways to beat the competition and get the slightest edge was just crazy and led to some insane finds from bypasses to undocumented APIs to admin tokens... the list goes on.
And to see some great talent go on to build even greater things is just amazing. I'm not surprised in the slightest way.
18
17
507
52,175
We still have thousands of happy renewing users. If there was no profit to be made people wouldn't be renewing month after month. None of our tweets are desperate, just want to state the facts 🤷♂️
2
14
5,538
Plus we offer an easy way for past users to resubscribe and we've waived the initial fee. We never sold you a license for 5k...
We're consistently taking the majority of Shopify stock on drops - it's still and will continue to be a competitive product
2
5
2,536
I get where you're coming from but you have to understand that it wasn't feasible for us to have people renew whenever they wanted for a single drop...
At the end of the day it's a business and if we can't cover our expenses then we wouldn't still be here.
3
2
4,573
Good work @jmwind 🤝
6
3
122
125,559
Can't blame us entirely for this... Your end was terribly slow too, I wouldn't mind finishing the project if you're still down tho!
5
26
Cost Palace a free pair of socks tho 😅 I did report this on Hacker One after proved working but never got my bounty 🥲
1
14