I think it's fixed now.
The basic move was to post something mildly controversial in your "profile page" -- which often used the MySpace style of "whatever HTML you want" -- along with a cookie logger. Then be obnoxius in chat/forums. Pretty soon, an admin would visit your profile to check out the offending content and ban your account. In the process, they would give you their admin cookie.
I was a dev/admin for a few of these browser-based games and would also poke at other people's games, so I was saw both sides of the arms race.
That wild west still exists in browser based games, which were labors of love with large enough user bases to keep the steam going but not commercially viable enough to justify any sort of actual investment.
There are still a half dozen or so browser based games running on huge piles of PHP written by middle schoolers and high schoolers in the mid to late 2000s. Many still have XSS and SQL injections lurking in forgotten little corner features.
Had a similar hack occur on a clients website at work. They sold flowers I think, and gift cards. But the max value was like $30 and we got gift cards for $100/$1000 but they only paid $1. I wasn’t invoked in that bug report but I suspect it was a similar issue.
The good old days.
I think the story was that in the really early days, orders were fulfilled by hand by humans looking at a screen or a printed page. No one was expecting to see a negative value, so in the fast-paced fulfillment workflow, the negative sign was missed or interpreted as a separator. Your account would get credited and you'd receive a book!
> I was the 2nd programmer at Amazon,
Shit... I seriously hope you got some equity haha. Right place, right time.
Hopped on a WebEx, and they were trying to add -1 of the item to their cart. I understood how they thought it could work, but can't recall a site where it actually worked that way.