• 首页
  • 博客
  • 项目
  • 留言墙
  • 友链

© 2025 xyspg.  GitHub

首页博客项目留言墙友链

Adapted from CaliCastle

总浏览量 6,637
最近访客来自 Dallas, US🇺🇸
  • Procedures
Chalk Infinite Course Election Coins Bug Analysis
2023/08/26技术向

Chalk Infinite Course Election Coins Bug Analysis

Chalk is a course selection platform that uses "Course Coins" for students to choose their classes. Unlike traditional platforms where students have to quickly grab available slots for courses, Chalk determines course admission through a lottery based on the amount of Course Coins students bid. This opens up the possibility for bugs to appear and for manipulation of the Course Coins.

272次点击1分钟阅读

Disclaimer: This document is intended solely for technical discussion and educational purposes. The reader is advised against attempting to reproduce the bug. The author disclaims all responsibility for any adverse effects that may arise from using this information.

Procedures

  • Download Postman and Postman Interceptor Chrome Extension
  • Open course selection page, remove all your existing courses, then select courses you desire. Fill appropriate amount of coins for each course, ensuring that there are minimum 99 coins (or your desired value) after filling all the courses.
  • Open Postman Intercept extension and start capturing.
Click "Start Capture"
  • Submit courses. Then stop the capture.
  • Open Postman and select "Requests" Tab.
  • Find the POST request with URL ended in $batch
  • In the request detail tab, select Body tab. Using ⌘F/Ctrl-F to open search panel and look for keyword coins.
  • Change the value of coins to 99, or your desired value (must within the range of your remaining coins)
  • Send the request. Response should show "Success"
  • Now go back to the webpage and refresh. You should see new courses are created with new values.
  • Remove the courses with old values. You may notice that the newly added 99 coins course is actually removed from the list. However, there is no need to panic as the removed course will be displayed correctly after refreshing the page.
Previous courses with 1 coin are correctly removed
  • (Optional) To make sure your courses are updated, open Chrome Dev Tools and select Network panel. Select Fetch/XMR filter. Find the request ending with query . You should see the coins are 99.

Info: If you send multiple requests, the corresponding number of course will be shown. However, this action is not recommended because it might result in unexpected behavior.

相关文章

基于 Socket.IO 的电子化指令游戏实现

2023/04/09技术向18811分钟阅读

解决 Cloudflare 521 错误

2023/02/21技术向1612分钟阅读

为 Docusaurus 博客页面添加评论区

2023/02/19技术向1452分钟阅读