“Can you hack your way to a $5.50 flight to New York?”
That’s what I set out to explore — armed with a proxy, curiosity, and way too much coffee.

Free Article Link Here

Welcome to my deep dive into a real-world pentesting session targeting a flight booking platform (name redacted for responsible disclosure). This wasn’t a wild zero-day fest, but a structured, methodical test that explored some juicy attack surfaces — price manipulation, affiliate spoofing, token abuse, replay attacks — the usual suspects in the bug bounty lineup.

Spoiler: The backend held strong. But the ride? Oh, it was worth documenting.

Recon & First Signs of Fun🕵️‍♂️

My target? Let’s call it SkyJet — an airline booking brand with several regional flavors (think SkyJetUS, SkyJetNL, BudgetFly, etc).

While poking around their frontend, I noticed the booking flow made multiple API calls that looked like this:

• /edge/order/ace – cart/order creation
• /edge/order/pax – passenger details
• /edge/order/payment – payment setup

What caught my eye were the custom headers being passed along:

• Affiliate-Internal-Code
• Brand
• Cid
• Checkout-Session