PayPal AB cloaking - I think I built the plugins

[salu]

Okay got the answer! the function used for redirecting (wp-redirect())not at all exposes the high risk site (Site A) to paypal not even as referrer. So yeah I've somehow nailed this down. Will most probably tomorrow post the demo video link for more closer look for someone who can help me see the points I might be missing.

Changes needed Wp-redirect() does exposes referrer though this is resolvable by explicitly ignoring refer policy. Most probably the setup will be completed with this and I'll be looking forward to you guy's opinions on if there's anything I might be missing.

 

[Machiavellianism]

Hey, so I've a replica store running for months with no sales and once I got an order but customer asking for PayPal and I said no. Then I started looking for ways to get PayPal as payment method on my site without issues and I came up with AB cloaking on BHW only. Saw there're sellers already selling the script for outrageously high amounts ~$3k, I couldn't even afford $100 given my current situation so I decided to build my own since some good guys in replies explained how it works.

So here's how my current setup on WordPress (woocommerce) works or "The Workflow":

- User fills out checkout form, selects PayPal as payment method (custom script/plugin) and proceeds to pay.
- In backend the script sends order data to site B (low risk) then site B creates PayPal order in it's name (site B's data is known to PayPal as it calls paypal to generate checkout url).
- Site B gets the payment url and send that url to site A (high risk) and site A redirects user to PayPal for payment directly. Note that user never saw site B in the process and everything happened in the background.
- User pays/cancels whatever is the payment status the user is sent back to site A after payment, site B's existence is never revealed to the user (not even in the url bar).
- PayPal's API call log - request's application context shows return_url for successful payments and cancel_url for cancelled payments that has site B's (low risk) data (url) in it.

The coolest thing about this setup is it does hides Site A from PayPal (as it was made for) but also hides mediator (site B) from end user which is my opinion awesome since end users might get suspicious of unknown domains/url redirections.

Now, please let me know if I'm just hallucinating over this success by missing out anything that might be exposing site A. Or I've actually succeeded in this as I believe I've done it since API even logs doesn't shows site A existing!

If you guys want me share the working demo video of the plugins built with settings page in WordPress do let me know. Looking forward to your opinions over this. I Succeeded or not?

Sounds pretty interesting. Mind shooting me a PM?

 

[salu]

Sounds pretty interesting. Mind shooting me a PM?

I'm unable to send direct message, I believe 15 posts are required to be made forst in order to send direct messages on BHW.

 

[Machiavellianism]

I'm unable to send direct message, I believe 15 posts are required to be made forst in order to send direct messages on BHW.

Yeah they need to get rid of that limitation. Hit me up on Discord if you don't mind.

discord: tactileuser

 

[salu]

Yeah they need to get rid of that limitation. Hit me up on Discord if you don't mind.

discord: tactileuser

Sure will do

 

[salu]

Yeah they need to get rid of that limitation. Hit me up on Discord if you don't mind.

discord: tactileuser

Sent friend request on discord. Although I'm able to now send dm's here will hit up here too.

 

[rileyfreeman22]

Everything working smoothly?

 

[salu]

Everything working smoothly?

I'm yet to test things out. Was busy in internship selection process for last two weeks thus didn't had time to test the plugins. I'll update the thread with demo video and workflow modifications after tests!

 

[YQuick]

Any news please ?

 

[networth]

I'm interested in your solution. Mind sending me a DM?

 

[tranv1807]

Hey I am interested too!

 

[pluggish]

Hey, so I've a replica store running for months with no sales and once I got an order but customer asking for PayPal and I said no. Then I started looking for ways to get PayPal as payment method on my site without issues and I came up with AB cloaking on BHW only. Saw there're sellers already selling the script for outrageously high amounts ~$3k, I couldn't even afford $100 given my current situation so I decided to build my own since some good guys in replies explained how it works.

So here's how my current setup on WordPress (woocommerce) works or "The Workflow":

- User fills out checkout form, selects PayPal as payment method (custom script/plugin) and proceeds to pay.
- In backend the script sends order data to site B (low risk) then site B creates PayPal order in it's name (site B's data is known to PayPal as it calls paypal to generate checkout url).
- Site B gets the payment url and send that url to site A (high risk) and site A redirects user to PayPal for payment directly. Note that user never saw site B in the process and everything happened in the background.
- User pays/cancels whatever is the payment status the user is sent back to site A after payment, site B's existence is never revealed to the user (not even in the url bar).
- PayPal's API call log - request's application context shows return_url for successful payments and cancel_url for cancelled payments that has site B's (low risk) data (url) in it.

The coolest thing about this setup is it does hides Site A from PayPal (as it was made for) but also hides mediator (site B) from end user which is my opinion awesome since end users might get suspicious of unknown domains/url redirections.

Now, please let me know if I'm just hallucinating over this success by missing out anything that might be exposing site A. Or I've actually succeeded in this as I believe I've done it since API even logs doesn't shows site A existing!

If you guys want me share the working demo video of the plugins built with settings page in WordPress do let me know. Looking forward to your opinions over this. I Succeeded or not?

Hey do you have any updates on this? Would be good to get in contact