Trail Shop checkout

Every constraint on this form helps you fill it in. None of them protects the shop.

Up to 5 per order.

Calculated by the page from the price and quantity.

Express is for members.




4 to 12 capital letters or digits.

Tamper with it in DevTools

  1. Open DevTools (F12, or Cmd+Option+I on a Mac) and choose the Elements panel. If this page is in a frame, open it in its own tab first.
  2. Find <input type="hidden" name="price" value="129.00">. Double-click the value and change it to 0.01. Do this last if you also change the product, because the page resets the price when the product changes.
  3. On the quantity input, delete min and max, then type -3 or 500.
  4. On the total, delete readonly and type 0.01.
  5. On the Express option, delete disabled and choose it.
  6. On the name and coupon fields, delete maxlength and pattern, and paste in something long or odd.
  7. On the consent box, delete required and leave it unticked.
  8. Place the order. The new tab shows what the server received: price=0.01 and every other value you chose.

No DevTools, on a phone for instance? The Tamper for me button makes the same edits with a few lines of script, which is a third way around the constraints.

Or skip the page entirely

The server cannot tell this request from a real order placed through the form:

curl https://cse134.site/api/echo \
  -d product=boots-trail -d qty=1 \
  -d price=0.01 -d total=0.01 \
  -d shipping=express -d name=Pat

No consent was given, no browser was involved, and the quantity, price and shipping are whatever the sender typed. Only the server can say no.