Help/Support Question about IAP receipt

jagster · October 26, 2020

Hi Everyone,

I'm not very familiar with IAP fake receipts and was wondering If I could get an answer to this question. I'm currently jailbroken on IOS 13.5 with unc0ver and I do know about LocalIAPStore and how it's able to generate fake receipts. I was talking to a user bragging about how he was able to bypass server-sided IAP. He explained it briefly and said he first made a real purchase in the app and then he was able to duplicate that receipt and was able to purchase repeatedly using that duplicated IAP receipt without him being charged. Is this even possible? How would you even go about this?

0xNoctis · October 29, 2020

Mt Guess would be look into altering the data/packets sent back and forth between you (the client) and the game (the server). If the server doesn’t perform sufficient validation checks, there could be an opportunity to hack

Jayelrey · December 17, 2021

To extend to this question how would you be able achieve this ? Looking to try on a game

dzee11 · April 5, 2022

On 10/28/2020 at 8:57 PM, 0xNoctis said:

Mt Guess would be look into altering the data/packets sent back and forth between you (the client) and the game (the server). If the server doesn’t perform sufficient validation checks, there could be an opportunity to hack

Hey @0xNoctis, can you explain this to me please? I would like to see if this possible for NBA2Kmobile? Thanks!