[steinuil]

I like to scan the "specialized" bar/QR codes I come across in my daily life in case they're not just URLs. Sometimes I find some interesting stuff and possibly some opportunities for mild exploits.

The other day I was at burger king. They allow you to refill your drink as many times as you like within 60 minutes of purchasing it, and the way this restriction is implemented is by having you scan a QR code they print on your receipt at the drink machine. I scanned the QR code with Binary Eye (android app that reads all sorts of barcodes, highly recommended). It contained some numbers I couldn't immediately recognize as interesting, a timestamp in a format similar to 202409231049, and a UUID.

Now, the UUID is probably the ID of the order in their internal system, so the question is: does the drink machine only read the timestamp or does it also use the UUID to query the internal system to re-validate it? Can you craft a QR code with the same data but change the timestamp to achieve for infinite refills?

[TeMPOraL]

> Can you craft a QR code with the same data but change the timestamp to achieve for infinite refills?

Well, can you? :). It's the obvious next thing to try, given that Binary Eye is conveniently also a barcode generator, not just a scanner.

[steinuil]

I know, but sadly I did not have enough time to stay there for more than an hour and try it out.

[always_imposter]

>Can you craft a QR code with the same data but change the timestamp to achieve for infinite refills?

I'm hoping nobody is this naive to let your client have mission critical info to implement something as crucial as giving a discount or refills in your case. It would be just be an extra column in your db table, the only identifier available to the user should be just the UUID, along with some identifier.

[steinuil]

I don't think this is that critical; if you stay there long enough and regularly go to refill your drink or come back the next day and make a beeline for the drink machine I think the staff would notice something's off.