Hacker News new | ask | show | jobs
by micahgoulart 4403 days ago
> I resisted the temptation to use the exploit to send myself a million dollars worth of free Amazon gift cards

Sorry, but that's not how Amazon's "Buy It Now" option works. It sends the item to the default address on file. So it would not be possible for the clickjacker to get it mailed to their own address.
2 comments
joshfraser 4403 days ago
You can send a gift card to an email address that you specify. I can't seem to do it now, but I remember being able to pre-populate the email address using a GET variable:

https://www.amazon.com/gp/product/B004LLIKVU/gcrnsts?ie=UTF8...

link
giulianob 4403 days ago
Would it be possible to use this to sell items with you as a referral and get paid commission?
link
joshfraser 4403 days ago
Yes, but even better, you could list your own products on Amazon and get paid whatever amount you want. Of course, there's no way to stop the email receipts from Amazon, but you might be able to get away with it for short period of time.
link