Okay guys now it's time for case number one race
condition stealing money from
a bank. What I'm going
to present to you in this case is how to hack the
web application with multifreading.
Multi-threading is very much related to
race conditions.
In other words via multifredded attack,
we can trigger race condition
and Via race condition. We
can launch some really powerful attacks. For
example stealing money from a bank
and this is exactly what I'm going to show you
here in this case.
Of course, I'm not going to
hack a real Bank. This is the training and
whatever. I'm presenting here is for educational
purposes only but to show you
how it works and to show you the power of race condition
exploitation. I need to have a demo and I have
one
And my demo is located at training the
local/bank in my testing environment. So let
me go there right now and let me show
you how this attack Works step by step.
Okay, here is my demo. What I
can do in this demo is I can transfer money
from one account to another account to
be more precise. I can transfer money from
Michael's account to James account.
And the current balance is $1,000. So I
cannot transfer more than $1000
right? And if I try to do it
and for example, if I try to transfer 1,001
which is
more than 1,000 then I will
see a message failure. You don't have 1001 dollar.
Well, this is very much expected. And if
I was able to do it, then there would be
a disaster in the system, right?
So this is how it works. This is how my
demo looks like. Okay, what
I'm going to do right now
is I'm going to move a smoothly
to the attack that
I'm going to actually present here and the attack is race conditions
the link money from a bank.
So right now you can see that I cannot
transfer more money than I have. But what
you will see in the upcoming minutes of
this video is that actually I can
with row more money than I have via
race condition exploitation and it's
gonna be really great. You really beautiful and it's
gonna be an eye opener for for many
people that we can do something like this via race
condition exploitation.
Okay. So yeah, let's do it. Let me
show you how it works.
So now I'm gonna present to you how this
attack Works how to trigger race condition
and how to still money from a bank, but we
also need some technical explanation
behind this attack. So once this attack
is presented to you, once you see the power of
this attack, then I will jump to the Whiteboard and
I'll try to explain to you why it actually
works. Okay. So first I will present you that indeed
it works and how to make it work and
later on. I will explain you some technical details
behind this attack so that you can really understand in
you know, why it works
great. So let's do it. Let me
present this attack to you.
As I told you at the very beginning we are
talking here about multifredded attack.
So multi-threading is a
kind of prerequisite or starting point for
this attack.
So we need a kind of a tool that supports
multi-threading.
I could use burps with Pro which is
not a free tool you need to pay for this. But you
know, I just want you to be able to do all
the attacks that I'm presenting here with free
tools. So I'm going to
use over zap instead of
burps with Prof in my testing environment in
order to show you how it works.
first let me
open overs up.
And what I have to do more right now the
ovas zap is up and running is I need
to tell my browser that now the
traffic send out from my browser should be actually sent
to overzab. Okay, so I
need to tell my browser about this.
So yeah, now everything is let's say configured properly
over zap is up and
running and my browser knows that the traffic going out
from the browser should be sent to overzapp because
in a couple of minutes, I'm gonna use over zap
and multifreezing out there to launch
my attack. Okay. I hope that you are following me till this
point.
Great. So now I'm about
to send and Money
Transfer request and what you can see here below is
amount $10. So yeah, let's send
$10 from one account to
another account and let's incorporate
this request related with
money transfer into multifredded
attack scenario. Okay.
So this is exactly what I'm going to do right now. So first I
need to turn on the Interceptor in
the oversp.
Now it is turned on and I'm going to click
send money. Okay? Let
me right now go to ovas zap.
And what you can see is that indeed the request
has been intercepted and this request
is responsible for sending $10.
From one account to another account, right and
I told you that the crucial part
here the starting point actually of
the attack is multi-threading. So I'm
going to take this request and
I'm going to incorporate this
request in multifred attack scenario.
And the question is how to
do it how to do it in oversupp. You can
do something like this. You can click right on this request. You
can click fuzz
And well this request actually is
going to be used by the
father, right?
And first we need to specify the
payload, you know position because this
is the father. So the father needs to know where the
fasting should happen in which place
But in the context of this case that I have here, I
don't want to do a fuzzing over a specified parameter.
I just want to send this
request many times, you know concurrently in
the multifred manner. So the payloads gonna
be now empty right, but I have to tell this
message, you know to to the
father so that it knows that the payload is
now empty. So I'm gonna go to payloads right
now. I'm gonna click add.
And I'm gonna choose empty now.
And now number of repetitions. So how many
times I want to ascend this,
you know request actually
to do web application, let it
be like 200. Okay. Why
not?
So yeah, this is it and I'm gonna click ok, so I
am about to send this one particular
request 200 times.
To do web application and this request is about money transfer
$10 from one account to another so in
the best case scenario from
the attacker's point of view. I will
be able to withdraw 200 times
10 dollars right from the
account. So $2,000. This is the hypothetical
theoretical the best
case scenario, right? So if I'm able to
if I am actually making a money transfer ten
dollars 200 times then if this exploit
works then at maximum I can
You know, we've wrote $2,000 but this
is a theoretical maximum. You will see what it means
actually later on in this video. Okay, so I
believe that this is clear for you. So so far we have
configured the father to send one
request 200 times without any
modifications just the same request. But as
I told you a couple of times
already in this video multifreading is the prerequisite
for this attack. So now you need to
go to options here.
And there is something like concurrent scanning
threads per scan here. Our
multi-threading can be configured.
So let's choose. For example 20
right now. The concurrent scanning
Frets per scan is 20. This is
how I'm configuring multifredded attack
in my father. Okay, which is really fundamental piece
of of this exploit here.
Great.
So right now I've got everything I've
got multifredding implemented. I'm about
to send this request 200 times. So
let me do it right now and let me click Start further.
You know, it's blazing fast.
We've got multifreading we've got concurrency here.
So it has been finished very quickly.
Now, let me release the Interceptor here.
Let me refresh my
web application and let me show you what's the consequence of
of this attack? Okay.
What you can see here is that.
Well, I was able to transfer 1,090. It's
really cool. I had
only 1,000 and I was able to transfer
more I was able to transfer 1090
so you can clearly see Michael
zillord dollars James 1090. It's
just you know amazing. It works. This
is how you can actually use multifreading to
trigger race condition and Via race condition how
we can still some money from a bank. So what I have
presented so far to you is how this
attack works and how to make it work. Okay,
and you see the power of this attack, but what
I have to do more in this
video is I just want to explain to you
why it works. Okay.
So let me go right now to the Whiteboard and
let me provide some more explanation.