[Hack] 4 Pieces Original Chicken (or Hot & Spicy Where Available) $7.45 @ KFC (Desktop Browser Required)

Since the previous hacks stopped working, I started looking into new methods of getting cheap chicken. I noticed that the KFC app seems to only perform client side validation of whether your cart is valid (very bad cybersecurity), so I found a new method of getting the hack which works on the KFC website ordering. The method involves performing a replay attack on the add to cart request sent to the server. Unfortunately this method only works on PC, so it is not very convenient to use, but I believe that it might still be possible on the app due to lack of server side cart validation.

Steps:

1. Open KFC website (https://www.kfc.com.au/menu/shared-meals/burger-feast)
2. Add burger feast to cart (Other feasts might also work)
3. Open browser developer tools (Ctrl + Shift + I), then go to the network tab
4. Add the add on you want to cart
5. In the developer tools, identify the network request that corresponds to adding the add on to cart (POST request, URL ends with /line-items)
6. Go to cart and remove the feast, it will remove the add on as well. (Hint: do this in another tab so the developer tools does not get cluttered with extra network requests).
7. Go back to browser developer tools and replay the request identified in step 5. (right click, then Resend in Firefox or Replay XHR in Chrome)
8. Refresh the cart page and the add on should be in there.

See also which does not use developer tools and can be performed on mobile:

1. Open 2 tabs of the KFC site.
2. On tab #1, add the Burger Feast to the cart and do not press anything when Add-ons menu appears.
3. Switch to tab #2 and navigate to cart and remove the feast
4. Switch to tab #1 and click Add to Order on the add-on you want.

http://kfc.com.au/