Hidden

C Verified account @unreleased · Sep 14

The Adidas stock bypass:

So this was only protected on the Akamai WAF layer rather than being removed from the website meaning any Akamai bypass on the path would let me access the endpoint as if it was normal.

The rule spec was any path directory with "Product-GetAvailability" would be blocked. I had to find a way to trick Akamai into thinking it was a different path whilst the origin still returned the same content

The specific bypass for this was appending: "; %2f" before "Product-GetAvailability".

Akamai interacts with semicolons very strangely, it would ignore everything after the semicolon up until the next forward slash, in this case it was the %2f (encoded "/") This caused Akamai and the origin to disagree about what the URL truly means. Akamai thought it was different but Adidas' origin normalized it to the same demandware URL returning the correct response.

The reason for the massive quantity parameter was because if you put 1,000 it would only return up to 1,000 in the "IN_STOCK" quantity.

View quoted post on X