Skip to content

Commit 892fd2f

Browse files
prakhar0x01prakhar0x01
authored
Adding Bug type : Race Conditions
1 parent 119a3c6 commit 892fd2f

File tree

1 file changed

+136
-0
lines changed

1 file changed

+136
-0
lines changed

‎Race Condition/RACE-CONDITIONS.md

+136
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,136 @@
1+
# RACE CONDITIONS
2+
## What is Race conditions ?
3+
- Race conditions are a common type of vulnerability closely related to business [logic flaws](https://portswigger.net/web-security/logic-flaws).
4+
- They occur when websites process requests concurrently without verifying. This can lead to multiple distinct threads interacting with the same data at the same time, resulting in a "collision" that causes unintended behavior in the application.
5+
6+
<hr>
7+
8+
## Limit over run RC (Exploiting Logic Flaws)
9+
- There are some basic RC tests that you can try in the context of Logic Flaws.
10+
- Invite user
11+
- Joining a group
12+
- Like, subscribe, follow, unfollow, Vote ..etc that required limit.
13+
14+
### This method required Burp version 2023.9.x or higher (This is the easiest method to exploit, you can create your own script also.)
15+
1 - Send the request to repeater for `'n' no. of times`.
16+
2 - Create a Tab for all those request and choose `Send Parallel (single Packet Attack)`
17+
3 - Hit send , if application is Vulnerable, you'll see the magic.
18+
<hr>
19+
20+
## Rate-Limit Bypass via RC
21+
22+
1 - Select the parameter in request that you want to bruteforce(let's say password), and `send the request into TurboIntruder`.
23+
2 - If it is password or something , then wordlist should be copied in your clipboard that and use the below python script in Turbo Intruder.
24+
25+
```
26+
def queueRequests(target, wordlists):
27+
28+
# as the target supports HTTP/2, use engine=Engine.BURP2 and concurrentConnections=1 for a single-packet attack
29+
engine = RequestEngine(endpoint=target.endpoint,
30+
concurrentConnections=1,
31+
engine=Engine.BURP2
32+
)
33+
34+
# assign the list of candidate passwords from your clipboard
35+
passwords = wordlists.clipboard
36+
37+
# queue a login request using each password from the wordlist
38+
# the 'gate' argument withholds the final part of each request until engine.openGate() is invoked
39+
for password in passwords:
40+
engine.queue(target.req, password, gate='1')
41+
42+
# once every request has been queued
43+
# invoke engine.openGate() to send all requests in the given gate simultaneously
44+
engine.openGate('1')
45+
46+
def handleResponse(req, interesting):
47+
table.add(req)
48+
```
49+
50+
3 - Hit Attack and see the magic.
51+
52+
<hr>
53+
54+
## Multi-Endpoint Race Conditions
55+
56+
1 - When a single functionality chains with multiple request , eg - `Buying a product from a E-Commerce application`
57+
58+
- /product --> for the product
59+
- /cart --> Add to cart that product
60+
- /cart/checkout --> Buy that product
61+
62+
2 - Send all the required request into burp repeater for the product you want in a sequence and create a Tab.
63+
3 - Select `Send Parallel (single Packet Attack)` and hit send.
64+
65+
<hr>
66+
67+
## Single Endpoint RaceCondition
68+
69+
- If you've facing a functionality where new objects edit the older object and require email verification, then we can test there for RaceConditions, Eg. Email Change functionality
70+
71+
`Account A : Attacker --> [email protected]`
72+
`Account B : Victim --> [email protected]`
73+
74+
1 - Application has email change functionality, where the new requested email is updated over older email, and send the confirmation link to the user email address.
75+
76+
2 - Since, email is updated in DataBase and only confirmation is needed,
77+
78+
3 - So we `Send Parallel (Single Packet Attack)` of the changing email for,
79+
80+
`[email protected]`
81+
`[email protected]`
82+
83+
4 - In Backend, Because we request so much fast that when application server generate confirmation link for `[email protected]` at the same time `[email protected]` request is also reach their and application got confused to prioritise , As a result it sends both confirmation links on the same email.
84+
85+
5 - Impact : This will lead to Full Acount Takeover.
86+
87+
<hr>
88+
89+
## Time Sensitive Vulnerabilities
90+
1 - Send two parallel `forget password` request for `Attacker i..e Account-A`
91+
92+
2 - If both `password reset links contains same token`, then we can test their for ATO.
93+
94+
3 - This time send both request again by `changing victim's username/password in one of them`.
95+
96+
4 - Analyze the response time, if `both request have same response time`, then their might be chances of ATO
97+
98+
<hr><hr>
99+
100+
# REAL World Cases : (H1 reports)
101+
102+
### 1 - Race condition in flag submission
103+
- [Found in --> HackerOne](https://hackerone.com/reports/454949)
104+
- Report describes a Race Condition Vulnerability which `allow an authenticated user to submit the same ctf Flag multiple times`. Increasing the user points and therefore the chances to get an invitation to a private program.
105+
106+
### 2 - Race condition on Invite user action
107+
- [Found in --> Omise](https://hackerone.com/reports/1285538)
108+
- Race condition vulnerability which `allows the invitation of the same member multiple times to a single team` via the dashboard.
109+
110+
### 3 - Race condition in performing retest allows duplicated payments
111+
- [Found in --> HackerOne](https://hackerone.com/reports/429026)
112+
- By executing `multiple requests to confirm a retest at the same time`, a malicious user is paid multiple times for the retest. This `allows for stealing money from HackerOne`, which could go unnoticed by both HackerOne and the attacker.
113+
114+
### 4 - Race Condition leads to Un-Deletable group member
115+
- [Found in --> HackerOne](https://hackerone.com/reports/604534)
116+
- Small Race condition bug in which a group `user couldn't be removed from the group even by the admin` after they join.
117+
118+
### 5 - Race Condition when following a user
119+
- [Found in --> every.org](https://hackerone.com/reports/927384)
120+
- Race condition vulnerability when following a user. If you send the Follow requests asynchronously, you can `follow a user multiple times instead getting an error message`.
121+
122+
### 6 - Race Conditions in Popular reports feature.
123+
- [Found in --> HackerOne](https://hackerone.com/reports/146845)
124+
- This report describes a race condition bug which `allow an authenticated user to upvote or downvote multiple times a single report`, increasing its counter (and its rank on the hacktivity page).
125+
126+
### 7 - Race condition in joining CTF group
127+
- [Found in --> HackerOne](https://hackerone.com/reports/1540969)
128+
- A race condition in https://ctf.hacker101.com/group/join `allows a user to join the same CTF group multiple times`.The user will show up in the group member list multiple times, and affect the group statistics.
129+
130+
### 8 - Race conditions can be used to bypass invitation limit
131+
- [Found in --> KeyBase](https://hackerone.com/reports/115007)
132+
- Using Race conditions, attacker was `able to send out a total of 7 invites to his throwaway emails, obviously bypassing the 3 no. of invitations limit`.
133+
134+
### 9 - Race Condition allows to redeem multiple times gift cards.
135+
- [Found in --> Reverb.com](https://hackerone.com/reports/759247)
136+
- I've found a Race Condition vulnerability which `allows to redeem gift cards multiple times`. This how an attacker can easily buy stuff just buying one gift card and redeem it over and over again.

0 commit comments

Comments
 (0)