MattGibney / DarkThrone

Lovingly re-creating the DarkThrone experience.
https://darkthronereborn.com
1 stars 0 forks source link

Exploit Using negative numbers when training units #2

Closed MattGibney closed 5 months ago

MattGibney commented 5 months ago

Just tested out some validations, you can untrain citizens by sending over negative numbers :D

➜ project_api git:(main) curl 'https://api.darkthronereborn.com/training/train' \
 -H 'Accept: application/json, text/plain, */*' \
 -H 'Accept-Language: en-US,en;q=0.9,ro;q=0.8' \
 -H 'Connection: keep-alive' \
 -H 'Content-Type: application/json' \
 -H 'Cookie: DTAC=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VySUQiOiJVU1ItMDFIUUUyUUg2MU00TVMzVFNFNVMwVFlNVlEiLCJpYXQiOjE3MDg3OTU4NzIsImV4cCI6MTcwODg4MjI3Mn0.etEhJMm6JpbTGGmFWmdi2ugxRNsY2mpngDbcoONJ6xc; ph_phc_Tbfg4EiRsr5iefFoth2Y1Hi3sttTeLQ5RV5TLg4hL1W_posthog=%7B%22distinct_id%22%3A%2218ddf239e00435d-0554c020e8f8c2-1e525637-29b188-18ddf239e014928%22%2C%22%24device_id%22%3A%2218ddf239e00435d-0554c020e8f8c2-1e525637-29b188-18ddf239e014928%22%2C%22%24user_state%22%3A%22anonymous%22%2C%22%24sesid%22%3A%5B1708845669972%2C%2218ddf239e547c9-0d81210e11ffdd-1e525637-29b188-18ddf239e554cf4%22%2C1708845669972%5D%2C%22%24session_recording_enabled_server_side%22%3Afalse%2C%22%24autocapture_disabled_server_side%22%3Afalse%2C%22%24active_feature_flags%22%3A%5B%5D%2C%22%24enabled_feature_flags%22%3A%7B%7D%2C%22%24feature_flag_payloads%22%3A%7B%7D%7D' \
 -H 'DNT: 1' \
 -H 'Origin: https://play.darkthronereborn.com/' \
 -H 'Referer: https://play.darkthronereborn.com/' \
 -H 'Sec-Fetch-Dest: empty' \
 -H 'Sec-Fetch-Mode: cors' \
 -H 'Sec-Fetch-Site: same-site' \
 -H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/[121.0.0.0](https://121.0.0.0/) Safari/537.36' \
 -H 'sec-ch-ua: "Not A(Brand";v="99", "Google Chrome";v="121", "Chromium";v="121"' \
 -H 'sec-ch-ua-mobile: ?0' \
 -H 'sec-ch-ua-platform: "macOS"' \
 --data-raw '[{"unitType":"worker","quantity":-1}]' \
 --compressed
{"message":"Training Complete"}%

This makes it possible to untrain.

also tested and it seems that you can gain population by having negatives for any citizen type -> sent over -1000 defense got a lot of gold and population being able to attack with a nice offensive force

image