I put $5 into one of the slots, got up to $10 and cashed it at the kiosk. When you cash out, the slot prints out a ticket with a QR code that the machine scans. Got my $10.
Then I was just fucking around to see if I could get the thing to scan any other QR code and spit out money. While doing this I took a picture on my phone of the QR code and the text the QR code was using as a link or whatever popped up for me to copy
So I copied it, pasted it into a notes app. It was a long string of numbers and letters. Some slashes and stuff
The last letter was a g. I changed it to an h. Then went online to find a QR code generator. Found a site easily enough. Pasted the new string as a url for the generator. QR code pops up. I put my phone to the machine.
$10. I started dying laughing in disbelief.
Then changed the h to a j. And it worked. Then j to a k. And it worked.
I stopped there but got $30 plus the $10 I originally won (well $5 not including the $5 I started with).
Comments
I would erase this and shut up. lol.
You’re still working there? Ffs don’t post this. If you work there I’d assume you know where the cameras are. If there’s no cameras (which id he surprised if there wasn’t on something holding money) just do it a few times a week and enjoy a free hour paid
Deleted account, kept post?
So there’s a thing as free money.. 🧐
Find out what the machine is, if it is a locally self manufactured thing or bought from an actual manufacturer. If this thing is manufactured and is in retail, this will be exploitable everywhere they run these kiosks.
Map out where all these kiosks are being used, delete this post and go around the world making free money.
Bro I totally already screenshotted that shit homeboy Loki just put some of us up on some game
If your state licenses gambling machines you likely are both breaking general fraud laws as well as gaming laws. I would cut it out if I were you.
I’ll add only that the codes you’ve created probably worked because they will be used by the slot machine in the future.
So, you’ve basically stolen from future winners, instead of from the store itself. If those winners complain, the store will see that the codes were already redeemed and call the winners liars and thieves. Maybe even ban them from the store.
This store doesn’t have cameras? If you keep doing it eventually they will catch you so make sure that 30$ is worth it.
This didn’t happen. Changing one letter in the string of characters to generate a QR code is not going to generate a valid code. There are trillions upon trillions upon quadrillions of possible codes, and the odds of correctly guessing one that is active are astronomical.
Dawg, as a hacker, this is neat.
Also you might actually have a worthwhile bug bounty on your hands.
I’d recommend you delete this post, but keep the documentation and send a report to the vendor. Keep details out of the report except what you absolutely need to prove your exploit works.
Then wait for them to respond.
Also check the company to see if they have a bug bounty program or a vulnerability disclosure program.
Bug bounties are cool cause they’ll pay out for finding a vuln and helping them fix it.
Isn’t there a rule about gambling in your place of work? It’s open to all kinds of abuse.
I would confront the owner, return the cash, and show him what you learned. They will possibly reward you handsomely, or fire you…
Good job criminal, proud of being a thief.
Weird that someone admits to being a thief publicly. Lol
Cameras? You’re busted
Theoretically play the slots again or find a bigger payout ticket and compare the codes. Might just be a number/letter difference for a bigger payout. They might be littered around too, so you wouldn’t even have to spend any money.
Theoretically of course. Don’t do that.
The only way in which you will get away with this is management not investigating such a small variance.
You have left a digital foot print of exactly when you used the fraudulent QR codes.
Most gaming machines will report a total wins, total cash in and then a total “profit”.
Basic computing calculation is close to perfect with variances 99.99% deriving from human error.
A basic spreadsheet which they are more than likely using to ensure the end of night takings are correct, will point to the exact amount of money they are missing.
It just takes a quick skim of a transaction report to see three mysterious transactions (time stamped) which don’t align with the rest and a glance at the cameras to figure this out.
For thirty dollars I’d come clean and return the money. Regardless if your employers will not pursue you criminally.. stealing from a work place in this manner can and will most likely follow you.