[Tutorial] Auction Bug

So a couple days ago I found this auction bug that lets you bid on various unlisted items. The bid history is public so people quckly noticed, reproduced the bug and BP is probably about to dish out bans soon. Anyway, here's a quick tutorial:

Load auction and go to the network tab in devtools/inspect element.
Bid on a random item.
Select the POST request that got sent. It should be one of the first ones. Click on "resend" and edit the outgoing request.
F5 to get a new reload token. CTRL+U to display html, search for "reloadtoken" to find the new token.
You wanna edit the red highlighted values in the attached image. Replace the reloadtoken (once in the URL and once in the post body). Replace the lootId with the ID of the item you wanna bid on. Optinal: modify the amount of credits you wanna bid.
Send the request. If the bid went through, you should see a glitched entry in your current bids. If it doesn't appear, you either got it wrong or someone has already made a higher bid.

Here's a list of lootIds you can bid on:

equipment_weapon_laser_lf-4
equipment_weapon_laser_lf-4-pd
equipment_weapon_laser_lf-4-md
equipment_weapon_laser_lf-4-hp
equipment_weapon_laser_pr-l
ammunition_laser_rsb-75
ammunition_laser_ucb-100
ammunition_laser_rb-214
drone_designs_spartan
drone_designs_hercules
drone_designs_havoc
ship_cyborg
ship_hammerclaw
ship_mimesis
ship_hecate
ship_g-vanquisher
ship_g-sovereign
ship_g-peacemaker
drone_formation_f-03-la
drone_formation_f-04-st
drone_formation_f-05-pi
drone_formation_f-06-da
drone_formation_f-07-di
drone_formation_f-08-ch
drone_formation_f-09-mo
drone_formation_f-10-cr
drone_formation_f-11-he
drone_formation_f-3d-rg
drone_formation_f-3d-wl

EDIT: A little JS by Punisher to make it easier

Paste this function into console:

Code:

function bid(auctionType, itemId, credits) {
    jQuery('#auction_item_buy input[name="lootId"]').val(itemId);
    jQuery('#auction_item_buy input[name="auctionType"]').val(auctionType);
    jQuery('#auction_item_buy input[name="credits"]').val(credits);

    Auction.bidButton.removeClass('disabled')
    Auction.bidButton.click()
}

Then call it like:

Code:

bid('day', 'equipment_weapon_laser_lf-4', '50000')