Free pizza

Summary

During grandiosas "getyourfreepizza" event it was possible for users to get free pizza by going near one of the boxes randomly laid out by grandiosa. There was also a small chance of getting a nintendo switch instead of the pizza, which was what I was out after.

Tools used

Python as the primary programming language

Manual method

The simplest way to open the boxes without actually going anywhere is to locally spoof the device location. This can be achieved using the "Fake GPS location" application for android. By gradually going closer to the box through trial and error, it was possible to open the box and claim a free pizza.

Automatic method

The more advanced way is to bypass the GPS-verification completely. This is possible as the location is only verified by the client, and never even touched by the server.
This process can be split into two steps.

Send a request asking the server for the 5 closest boxes and their respective ID
Send a request to the server with the newly received box ID and your phone number as arguments

After this you will receive the SMS with a coupon code within 10 minutes.

Grandiosas anti-cheat

Prize cap

The first way they tried to stop cheating during the event, and initially seemingly the only way, was to set a hidden cap on the maximum amount of boxes that could be claimed per day. Although I did not find a specific number, I believed it to be around 1 box/phone number/day.

This is obviously a problem as I only owned a single phone number, and my chances of getting a nintendo switch would be quite low if I could only open a single box at per day. A simple solution was to send pizza codes to all numbers in my contacts, but after going through most of them and still not wining any nintendo switch I started looking for another way.

I settled on collecting a large amount of free SIM cards that are given out at some local shops and created a python script that iterates through them, sending them a pizza SMS with a random interval.

IP-address blacklisting

Some time after this, grandiosa put in another security measure. They started blacklisting IP-addresses that sent out suspicious requests, which stopped my python script from working. To solve this I compiled a list of free proxies I found online, and configured the python script to pick one of them randomly with each request.

IP-geolocation

At this point I had received hundreds of pizza coupon codes and none of them had been a nintendo switch, so when grandiosa started filtering by what I believed to be IP-geolocation, I did not believe it was worth the hassle and closed the project.

Result

When finished I had over 300 coupon codes for grandiosa pizzas, which is much more than I would ever be able to eat myself. I also learned a lot about web-application security, which lead me to other security related projects.

The python code for this project was unfortunately deleted.

Back to top