Okay guys now it's time for case number
two race condition reusing a
one-time discount code.
What I'm gonna present here is more race condition
exploitation because this is really powerful attack
and the case here is
gonna be a very popular case related to
online shopping in online
shopping platforms. We can
redeem one time discount code,
right? It's very popular functionality and
well as the name suggests one
time discount code can be used only
ones but we are hackers and we
can use race condition to reuse a
one-time discount code and at the
very end, we're gonna have a very nice profit. Okay. So let
me go to the demo.
I've got a demo as always the demo is
located at training the local slash sharp
in my testing environment and let
me show you how this attack Works in practice.
Okay, here is my demo. What
you can see here is a number of one-time discount
codes first. I'm gonna show you that indeed.
This codes are one time
discount codes. Okay, so let
me for example take this 1% discount
code.
And I'm gonna copy this guy and
I'm gonna redeem this discount code.
Okay, I did it for the first
time. Let me try for the second time.
And you see invalid discount code and this
is well a good message because well
the system works as expected what
I mean here is that this is a one-time discount
code so I cannot use it for the second
time. Okay. Now let me click here reset discount
code database because I just
want to show you that. Well, actually
I can reuse a one-time discount
code via race condition. So in order,
you know to start from the very beginning with this demo I
clicked reset discount code database in my
testing environment. Okay, great. And you see the message
discount code database has been reset and my
discount right now is zero, so I'm starting from
the scratch with this case.
Okay, the first we have to think
about this, you know functionality in
terms of race condition and we
have to think if race condition can happen here
or not. I explained to you in details
what the race condition is how it works and
stuff like that. I presented some you know drawings on
the Whiteboard, but here if you just take
the knowledge from the previous case and try to apply this
knowledge in this case, then you will realize something like
this that well indeed. There is a possibility
of launching our race
condition attack here because race
condition is gonna happen here
when accepting the
requests with a discount code
is faster than redeeming of
a discount code. Okay, I believe that it
makes sense for you. You always have to figure out about
what's gonna happen.
The system when we provide a one-time
discount code and try to imagine if this
race condition can happen or not. Right? So just take
a look at the functionality. Now, you've got a knowledge
about race condition race condition exploitation and
how it works and try to imagine if this is possible and here
in indeed. There is a chance that it's gonna
work. So let me repeat this stuff race condition
can happen when accepting the
requests with a discount code is
faster than redeeming of a discount code.
Okay chances are that it will work.
So yeah, let's do it. Let me repeat this
steps, you know from the previous case so that we
can exercise it even more. I mean
this race condition exploitation.
And let's check out what we're gonna see at the
very end. Okay, so I'm gonna take this 1%
discount code.
I'm gonna copy it here.
And I'm gonna click redeem
a discount code and I'm gonna actually intercept the
outgoing request because as you already know
from the previous case, we're gonna launch some multifredded
attack here in ovas zap. So first, I
need to intercept the outgoing request with
my one time discount code. Okay, so let
me go to ovas zap.
What I can see here is the request intercepted
from the previous case. So
yeah, let me forward it and let
me turn on
the Interceptor, right so the Interceptor is turned
on.
Now I'm gonna click redeem a
discount code.
and
here is my intercepted request
with one time discount
code and the next step is I'm
gonna click right here fuzz.
And I want to send this request,
you know, let it be 100 times.
Okay, so let's go to
payloads.
and
and let's choose empty now
as a payload and the number of repetitions 100, okay.
So I'm just repeating the steps that I presented
to you in the previous case and just a
reminder for you. I have chosen
empty null as a payload because well,
I just want to take this
request and send in many times in the
multifred attack scenario. Okay. I don't want to
change anything in this request. So I didn't indicate any,
you know payload position
here.
I wanted to be sent
100 times and now let me go to options and
let me configure this a multi-fredded
behavior. Okay?
So I'm gonna just again 20 so
concurrence scanning Frets per scam
is gonna be 20. So I've got right now
the multifredding configured in my
attack. So let me click Start father.
Yeah, it is blazing fast.
And now it is finished. So indeed,
it was really really fast. Now, I'm gonna release this
Interceptor and I'm gonna
refresh this web application here. Okay.
And what you can see is that your discount is
13%
So yeah, I've got a nice benefit from
this attack that I was able to
reuse a one-time discount code. I had
a 1% discount code
and I was supposed to see
1% discount but I launched
a race condition attack and Via
race condition. I was able to actually get
a much better discount which
is 13% Right? And again, this is
non-deterministic attacks. So I launch
it and you know here and this is
13% but dependently on different
things like network connection
and the speed of network connection the delays
out there. So the performance of the
network in general right or the performance of the
system where the web application is hosted like swapping I
told you in the previous case that swapping can have an
impact, you know on the
Of the system and and while the race conditions are
about fractions of milliseconds. So the question is,
you know, how many requests are
gonna win this race right here. So
I explained you all the details in the
previous case. So right now I'm just presenting you the next
case. So yeah, this is how it works. So you
see that indeed our attack works
and we are able to actually
reuse our one-time
discount code many times. And yeah, there
is a very nice profit. So this
is it. Let me right now jump to
the slides because I want to wrap up everything here.
So I presented to you very popular
functionality in
modern eshopping which is redeeming discount
code here. I
had one time discount codes. So
this discount code can be used only once
as the name suggests, but I launched race
condition attack and I was
actually able to reuse this one time discount code. So I
used many concurrent requests to
redeem this one time discount code.
And as I told you and the
race condition happens when
accepting the requests with
a discount code is faster than
redeeming of a discount code and I
always recommend you to think
about the potential race condition exploitation
scenario when you've got a given functionality
in front of your eyes. Okay, so you have to think
There is a potential of this kind of attack. And when I
started presenting this demo I explained to you why I
think that race condition can be really
an issue here, right? That's why I launched this
attack. That's why I want to check if this is really
possible or not.
So finally I was able to
reuse a one-time discount code via race
condition. And this is it. So you see
how it works. I I believe that this is clear for you you had
an opportunity to see yet or another
race condition exploitation or really popular now one,
you know in modern web applications.
So I believe that this is clear for
you. I believe that you like it we are done with
this case. So let me right now jump to the next
video.