I created a script that exploits a practical vulnerability in “Bolt” a popular European e-scooter app

Hey there, so I thought I’d post this here because I think it is quite interesting. The program makes it possible to use Bolt completely for free without being charged anything. So Bolt is a popular European e-scooter rental firm like Tier or Lime, only they got so popular because they in contrary to their competitors do not have an unlock fee, meaning you just pay for the time driven. That and the fact that if the ride’s duration is under 1 minute and 20 seconds, the user isn’t charged anything makes for a practical vulnerability of being able to send POST requests which quickly start and finish the ride every minute or so. I wrote the program in Python, and it is the first one of my scripts I actually posted online, so it would mean a lot if you guys would check it out: https://github.com/amstrdm/Bolt4Free

The code is far from perfect. I didn’t implement threading, meaning there’s not really a safe way to terminate the program. Also, since bolt’s API isn’t public the variables for certain headers have to be pasted in from account to account but all that you can see in the readme.md. It would also make a lot more sense to have it as an actual mobile app. If anyone is willing to contribute or cooperate on that, please go ahead and do so, as I have no experience in mobile development.

That’s it folks, let me know what you think 🙂

submitted by /u/cuzimrave
[link] [comments]

May 31, 2023
Read More >>