Hello, everyone, as we
are discussing about race conditions. Let's see
a hacker one report for this vulnerability.
As you can see over here race condition allows to
redeem multiple times gift card, which can lead to free
money.
interesting
so you can see the security researcher was
able to identify a race condition on this
website at an endpoint
which is redeem.
This is the raw request that can be seen which is
a post request sent to a
endpoint which is f i redeem in the body.
You can see there is a token which
says gift card.
Once he was able to send this request multiple times
using turbo Intruder. He was
able to see a 200. Okay multiple responses
as can be seen over here.
If we count this, this is equals to 1 2 3
4 5 6 7 so
he was able to successfully get or
redeem his gift card
seven times.
As you can see over here, he used one
coupon, but he was able to redeem it multiple
times and this indeed is known as
race condition as you can see. He was rewarded with
a handsome amount of bounty for this issue.
So let us try to replicate the same issue again or
let us at least understand how you can
write your own custom nuclei template for
issue like this.
So let's first quickly understand the
raw request. So this is a post method
to this endpoint with this body.
So I'm going to copy this and go to
our
Sublime Text
I have created a block which is ID race
condition info and in request as
we are using a raw request. I have used Raw.
And I have added the request over here.
Here just for testing. I'm adding the token
value as test coupon 10 and we
are keeping the race counters 10.
Let us just try to see and match how many 200 OK
requests we get when we try to redeem this
now keep in mind as we have not created an
account on this website. We do not supply a
csrf token the request might not
go through but still you would learn how
you can write a quick template for testing the
same issue.
Let's go to the browser. This is the endpoint which
still works as you can see where you can redeem your
River gift card. Let's run this quickly
on our terminal and let's see the output. So I'm
going to save this template and I'm going to say nuclei -
Q let's provide the target. So the
Target that we are going to supply is this
we need to supply the protocol.
Let us apply the template that we have created right
now.
So the template that we have created is race demo.yml
and let's hit enter.
You can see all those requests would go simultaneously
altogether. We can see
all the requests were sent together. And for none of the request. We
got a 200. Okay, and that's okay because
we did not create an account and not supply
a valid csrf token, but that's fine.
But you got an idea of how you can also
write your own custom race condition template using
this technique. Thank you.