Hello and welcome to this lesson.
In this lesson, we are going to understand about race conditions.
The race conditions are amazing.
We can definitely identify these category
of vulnerabilities on web applications, which could
lead to business logic issues as well.
And we all know that business logic issues are
generally least identified by security researchers
and Bug bounty hunters because they are
sometimes harder to test.
But with the help of nuclei we can
indeed test for race conditions as well.
So we are going to learn that how you can write your own
template that can help you assist in testing
for race conditions. If a web application has
been vulnerable to this vulnerability.
So race conditions is when multiple threads read
and write the same variable.
A very very common example is while using a coupon code
which only has a one-time validity.
For example, if you have a coupon code of $10,
and if you are able to redeem it 10 times you
have hundred dollars added into your account. Now
this directly impacts the organization and
create a business loss.
So raise conditions can be implemented using gate mechanism.
Example turbo Intruder in Pursuit as
well.
Now we are going to see in the Practical time
that how you can quickly write a template that can
assist you in identifying race conditions.
So let's quickly go to the Target first.
As you can see over here.
The target is test restart PHP.
Here you have to enter the coupon code.
Once you enter the coupon code correctly you are
able to redeem it.
So I have written a race condition template
that will help us in checking if
the target is vulnerable to raise condition or
no.
So the template is race condition dot. Yml,
this is the ID block.
Next is the info block.
Next is the request block which contains the method as
post as we want to send a
coupon code and check if it is valid or
no.
This is the path in which we are specifying the base URL
and this is the endpoint where we want to redeem our
coupon.
In the body, we have supplied the coupon code AS hackify 10
CS maybe to redeem $10.
We are supplied race as true.
Which means we want to perform race condition testing and
race count as 10, which means
we want to send 10 simultaneous request
together.
In the magic condition, we are expecting a response of
a status code. That is 200. Okay
and based on this we would match it.
You can also add matches condition which says
redeem successful or successful as
well.
Let's save this template quickly.
Let's go to our terminal.
here
we are going to say we want to send this request.
That template name that we have.
written so nuclei
We have specified our Target URL the
template that we have just written which is race
condition Dot, yml and hyphen V observe very
carefully.
When I hit enter.
The request has been sent simultaneously if
you can look over here the timestamp if
you look carefully at the timestamp, the
timestamps are exactly the same
that means 10 simultaneous request
was sent together to redeem the
coupon from which you can see
these many requests were successful these
wooden successful. The next
ones were also successful. So the verb
application if allowed us to redeem
the coupon we could have redeemed it multiple times.
I hope you guys understood how you can use the race
condition feature in nuclei by writing
a custom template like this that can
assist you in identifying business logic
issues on bug Bounty program as well. Thank
you.