• expired

[Hack] 4 Pieces Original Chicken (or Hot & Spicy Where Available) $7.45 @ KFC (Desktop Browser Required)

2120

Since the previous hacks stopped working, I started looking into new methods of getting cheap chicken. I noticed that the KFC app seems to only perform client side validation of whether your cart is valid (very bad cybersecurity), so I found a new method of getting the hack which works on the KFC website ordering. The method involves performing a replay attack on the add to cart request sent to the server. Unfortunately this method only works on PC, so it is not very convenient to use, but I believe that it might still be possible on the app due to lack of server side cart validation.

Steps:

  1. Open KFC website (https://www.kfc.com.au/menu/shared-meals/burger-feast)
  2. Add burger feast to cart (Other feasts might also work)
  3. Open browser developer tools (Ctrl + Shift + I), then go to the network tab
  4. Add the add on you want to cart
  5. In the developer tools, identify the network request that corresponds to adding the add on to cart (POST request, URL ends with /line-items)
  6. Go to cart and remove the feast, it will remove the add on as well. (Hint: do this in another tab so the developer tools does not get cluttered with extra network requests).
  7. Go back to browser developer tools and replay the request identified in step 5. (right click, then Resend in Firefox or Replay XHR in Chrome)
  8. Refresh the cart page and the add on should be in there.

See also alternative hack by ThristyCow, which does not use developer tools and can be performed on mobile:

  1. Open 2 tabs of the KFC site.
  2. On tab #1, add the Burger Feast to the cart and do not press anything when Add-ons menu appears.
  3. Switch to tab #2 and navigate to cart and remove the feast
  4. Switch to tab #1 and click Add to Order on the add-on you want.

Related Stores

KFC Australia
KFC Australia

closed Comments

  • The effort!

  • OP what is your day job? Im just curious…. XD

  • +1

    Anyone in for a JSON menu?
    https://orderserv-kfc-apac-olo-api.yum.com/dev/v1/catalogs/a…
    Probably should be read with the exclusions for that site too.

    Someone could try picking things out of the "Fomo Wow" category and try tampering with the add to cart post. Maybe use postman interceptor to grab the Auth session.

  • +1

    the 2 tabs trick works for me, but sadly I don't see option to modify it to Hot & Spicy in the browser :(

      • yeah, I usually go to KFC Sydney George Street.
        In browser, the options only available if I select normal menu (i.e 6 pieces of chicken), but not for the Add On.

        • What if you add it on the browser, and then update it in the cart on app?

          EDIT: nvm, it doesnt sync cart between browser and app lol

          • @CodeXD: It also doesn't sync between multiple instances of the app(same accnt), same if using 2 different browsers(or versions), it doesn't sync between them either.

            Multi instance app launches on the same accnt does allow for multiple redemptions of the same offer though.

            (Edit. Above is more relevant to Xmas July promotions)

    • Yeah it's useless for hot n spicy. (I'm in qld where every store has hot n spicy)

    • +1

      Browser addons, hack or legit, doesn't offer any customize/edit option for the addon, tried many devices and browsers.

      I grabbed 5 tenders addon hack and walked up to the counter and said, got this app order, forgot to customize the sauce, then hit At Store or whatever in front of staffer, and he said no problem what did you want, no problem.

      Granted that's less noticeable than changing 2 large sides for 6.95 to whatever or other changes we want to make but as long as it's not a store manager you're talking to, 'should' be fine.

    • +1

      It happened to my order as well but I just requested the staff to change my order to Hot & Spicy at the store and they honored it.

  • Weird, certain stores in the cbd are showing up as closed on the website however they're still open and available in the app. Anyone else having this issue?

  • I just noticed that the previous method was no longer working. Amazingly, someone have now identified a new method. Genius! 🙏👌

  • should've had this instead of appalling popcorn chicken today

    1. KFC App
    2. ???
    3. Jail
  • +6
  • Thanks OP and @thirstycow
    Browser hack worked on PC (didnt work for me on mobile)
    Cheers

  • The alternative hack worked for me!

Login or Join to leave a comment