I developed a Stripe cloaking system, need feedback

L

lehehroi

Registered Member
Joined
Dec 20, 2024
Messages
70
Reaction score
33
So I just wanted feedback on if there was any possible way stripe could bust my system, below is the process:

I have Website A (Blackhat) and Website B (Whitehat).

1) User clicks payment button on A
2) Website A backend makes an API call to Website B's API
3) Website B's API creates the Stripe hosted checkout
4) After successful/canceled payment, user is redirected to Website B's API again, which only then sends the hser back to Website A

I included no-referrer in Website Bs header as well. So based on my system above, is there any way that Stripe can tel of Website A's involvement?
 
Advertise on BHW
lehehroi said:
So I just wanted feedback on if there was any possible way stripe could bust my system, below is the process:

I have Website A (Blackhat) and Website B (Whitehat).

1) User clicks payment button on A
2) Website A backend makes an API call to Website B's API
3) Website B's API creates the Stripe hosted checkout
4) After successful/canceled payment, user is redirected to Website B's API again, which only then sends the hser back to Website A

I included no-referrer in Website Bs header as well. So based on my system above, is there any way that Stripe can tel of Website A's involvement?
Click to expand...
looks clean on the surface but stripe can still track things through user fingerprinting like ip user agent canvas webgl if too many users go through the same ips or a similar pattern they can flag it also make sure website a and b have different ips like use 4g 5g mobile proxies to avoid an obvious connection between them
 
GlobalProxy4g said:
looks clean on the surface but stripe can still track things through user fingerprinting like ip user agent canvas webgl if too many users go through the same ips or a similar pattern they can flag it also make sure website a and b have different ips like use 4g 5g mobile proxies to avoid an obvious connection between them
Click to expand...
thanks for that, ill look that up
 
GlobalProxy4g said:
looks clean on the surface but stripe can still track things through user fingerprinting like ip user agent canvas webgl if too many users go through the same ips or a similar pattern they can flag it also make sure website a and b have different ips like use 4g 5g mobile proxies to avoid an obvious connection between them
Click to expand...
do you have any further suggestions ?
 
Website A and Website B should be fully isolated from each other in terms of session and user data. And when making the API call from Website A to Website B, include no identifiable metadata and make sure the redirect back to Website A after payment is clean, with no session or identifiable data from Website B. Also, each site’s payment flows shud be entirely independent, with no cross-site session persistence or overlap in user tracking.
The ultimate solution is to implement end-to-end encryption (E2EE) for the entire communication.
 
yeah e2e is solid but even with full separation there are still invisible traces that can link both sites like browsing patterns, api response times, fingerprinting etc so you also need to randomize all that otherwise it's just an open door for detection
 
GlobalProxy4g said:
yeah e2e is solid but even with full separation there are still invisible traces that can link both sites like browsing patterns, api response times, fingerprinting etc so you also need to randomize all that otherwise it's just an open door for detection
Click to expand...
i see thanks for that, ill look into those. Thanks for all the help guys :)
 
I can offer you an affordable payment orchestration system. The system you're familiar with may be one of our earliest versions. Since then, we've released numerous updates and made significant improvements to the platform. PM me
 
I'm also interested in learning about this because I need it for my new peptide store. Please DM me. i'm still trying to figure how the Website A and Website B. My question is, do i make those changes to the dns on my domain hosting? any help would be greatly appreciated.ty
 
Site B: A legitimate business website used for integrations with PayPal, Stripe, and other payment providers. PayPal account applications generally do not require a website, so Site B can be provided through orchestration solution when appropriate. For Stripe, we recommend using the business website originally registered with the account, with consistent business information.
 
Which plugin for payment system? So is Website A site the real site where i show stripe my real store? or is that Website B? B/c Stripe is asking now what products I sell. not sure how to answer this or if I should transition before.
 
Stripe requires a legitimate, compliant business website (Site B) that does not involve counterfeit, infringing, or restricted products. comply with Stripe's verification requirements.
 
For example, unbranded clothing, garden decorations, fashion accessories, and other similar products are all suitable options.
 
uid25948301 said:
For example, unbranded clothing, garden decorations, fashion accessories, and other similar products are all suitable options.
Click to expand...
Okay i have my real site which sell peptides and fully store with products. Do I use another domain for my stripe payment application? or the real domain? b/c i integrated stripe with my real peptide store. they are asking questions like what do i sell. I havent replied back. Do I disconnect and connect store A- clothing store? and a different domain?
 
Advertise on BHW
You must log in or register to reply here.
Sign up now!

Main Menu

Home Main Forum List Black Hat SEO White Hat SEO BHW Newbie Guide Blogging Black Hat Tools Social Media Downloads

Marketplace

Account Selling Content / Copywriting EBooks / Methods Hosting Misc Proxies For Sale SEO - Link building SEO - Packages Social Media Social Media - Panels Web Design More

Making Money

Affiliate Programs Hire a Freelancer IM Journeys Making Money Pay Per Click Site Flipping Want to Buy

BlackHat World

Dispute Resolution Forum Suggestions & Feedback Introductions Lounge
Back
Top