Race Condition
Last updated
Last updated
Use to easily build and automate workflows powered by the world's most advanced community tools. Get Access Today:
The main hurdle in taking advantage of race conditions is making sure that multiple requests are handled at the same time, with very little difference in their processing times—ideally, less than 1ms.
Here you can find some techniques for Synchronizing Requests:
HTTP/2: Supports sending two requests over a single TCP connection, reducing network jitter impact. However, due to server-side variations, two requests may not suffice for a consistent race condition exploit.
HTTP/1.1 'Last-Byte Sync': Enables the pre-sending of most parts of 20-30 requests, withholding a small fragment, which is then sent together, achieving simultaneous arrival at the server.
Preparation for Last-Byte Sync involves:
Sending headers and body data minus the final byte without ending the stream.
Pausing for 100ms post-initial send.
Disabling TCP_NODELAY to utilize Nagle's algorithm for batching final frames.
Pinging to warm up the connection.
The subsequent sending of withheld frames should result in their arrival in a single packet, verifiable via Wireshark. This method does not apply to static files, which are not typically involved in RC attacks.
Understanding the target's architecture is crucial. Front-end servers might route requests differently, affecting timing. Preemptive server-side connection warming, through inconsequential requests, might normalize request timing.
Frameworks like PHP's session handler serialize requests by session, potentially obscuring vulnerabilities. Utilizing different session tokens for each request can circumvent this issue.
If connection warming is ineffective, triggering web servers' rate or resource limit delays intentionally through a flood of dummy requests might facilitate the single-packet attack by inducing a server-side delay conducive to race conditions.
Tubo Intruder - HTTP2 single-packet attack (1 endpoint): You can send the request to Turbo intruder (Extensions -> Turbo Intruder -> Send to Turbo Intruder), you can change in the request the value you want to brute force for %s like in csrf=Bn9VQB8OyefIs3ShR2fPESR0FzzulI1d&username=carlos&password=%s and then select the examples/race-single-packer-attack.py from the drop down:
If you are going to send different values, you could modify the code with this one that uses a wordlist from the clipboard:
If the web doesn't support HTTP2 (only HTTP1.1) use Engine.THREADED or Engine.BURP instead of Engine.BURP2.
Tubo Intruder - HTTP2 single-packet attack (Several endpoints): In case you need to send a request to 1 endpoint and then multiple to other endpoints to trigger the RCE, you can change the race-single-packet-attack.py script with something like:
It's also available in Repeater via the new 'Send group in parallel' option in Burp Suite.
For limit-overrun you could just add the same request 50 times in the group.
For connection warming, you could add at the beginning of the group some requests to some non static part of the web server.
For delaying the process between processing one request and another in a 2 substates steps, you could add extra requests between both requests.
For a multi-endpoint RC you could start sending the request that goes to the hidden state and then 50 requests just after it that exploits the hidden state.
Automated python script: The goal of this script is to change the email of a user while continually verifying it until the verification token of the new email arrives to the last email (this is because in the code it was seeing a RC where it was possible to modify an email but have the verification sent to the old one because the variable indicating the email was already populated with the first one). When the word "objetivo" is found in the received emails we know we received the verification token of the changed email and we end the attack.
Note that although this improvement makes the attack more reliable in RC that requiers hundreds/thousands of packets to arrive at the same time, it might also have some software limitations. Some popular HTTP servers like Apache, Nginx and Go have a strict SETTINGS_MAX_CONCURRENT_STREAMS setting to 100, 128 and 250. However, other like NodeJS and nghttp2 has it unlimited.
This basically mean that Apache will only consider 100 HTTP connections from a single TCP connection (limiting this RC attack).
Before the previous research these were some payloads used which just tried to send the packets as fast as possible to cause a RC.
Repeater: Check the examples from the previous section.
Intruder: Send the request to Intruder, set the number of threads to 30 inside the Options menu and, select as payload Null payloads and generate 30.
Turbo Intruder
Python - asyncio
There are many variations of this kind of attack, including:
Redeeming a gift card multiple times
Rating a product multiple times
Withdrawing or transferring cash in excess of your account balance
Reusing a single CAPTCHA solution
Bypassing an anti-brute-force rate limit
Exploiting complex race conditions often involves taking advantage of brief opportunities to interact with hidden or unintended machine substates. Here’s how to approach this:
Identify Potential Hidden Substates
Start by pinpointing endpoints that modify or interact with critical data, such as user profiles or password reset processes. Focus on:
Storage: Prefer endpoints that manipulate server-side persistent data over those handling data client-side.
Action: Look for operations that alter existing data, which are more likely to create exploitable conditions compared to those that add new data.
Keying: Successful attacks usually involve operations keyed on the same identifier, e.g., username or reset token.
Conduct Initial Probing
Test the identified endpoints with race condition attacks, observing for any deviations from expected outcomes. Unexpected responses or changes in application behavior can signal a vulnerability.
Demonstrate the Vulnerability
Narrow down the attack to the minimal number of requests needed to exploit the vulnerability, often just two. This step might require multiple attempts or automation due to the precise timing involved.
Precision in timing requests can reveal vulnerabilities, especially when predictable methods like timestamps are used for security tokens. For instance, generating password reset tokens based on timestamps could allow identical tokens for simultaneous requests.
To Exploit:
Use precise timing, like a single packet attack, to make concurrent password reset requests. Identical tokens indicate a vulnerability.
Example:
Request two password reset tokens at the same time and compare them. Matching tokens suggest a flaw in token generation.
The idea is to verify an email address and change it to a different one at the same time to find out if the platform verifies the new one changed.
If 2 different writes are used to add information inside a database, there is a small portion of time where only the first data has been written inside the database. For example, when creating a user the username and password might be written and then the token to confirm the newly created account is written. This means that for a small time the token to confirm an account is null.
Therefore registering an account and sending several requests with an empty token (token= or token[]= or any other variation) to confirm the account right away could allow to confirm an account where you don't control the email.
The following pseudo-code is vulnerable to race condition because in a very small time the 2FA is not enforced while the session is created:
authorization_codeThe problem appears when you accept it and automatically sends an authorization_code to the malicious application. Then, this application abuses a Race Condition in the OAUth service provider to generate more that one AT/RT (Authentication Token/Refresh Token) from the authorization_code for your account. Basically, it will abuse the fact that you have accept the application to access your data to create several accounts. Then, if you stop allowing the application to access your data one pair of AT/RT will be deleted, but the other ones will still be valid.
Refresh TokenOnce you have obtained a valid RT you could try to abuse it to generate several AT/RT and even if the user cancels the permissions for the malicious application to access his data, several RTs will still be valid.
Learn & practice AWS Hacking: Learn & practice GCP Hacking:
Check the !
Join the 💬 or the or follow us on Twitter 🐦 .
Share hacking tricks by submitting PRs to the and github repos.
For obtaining a deep understanding of this technique check the original report in
In the original research it's explained that this attack has a limit of 1,500 bytes. However, in , it was explained how it's possible to extend the 1,500-byte limitation of the single packet attack to the 65,535 B window limitation of TCP by using IP layer fragmentation (splitting a single packet into multiple IP packets) and sending them in different order, allowed to prevent reassembling the packet until all the fragments reached the server. This technique allowed the researcher to send 10,000 requests in about 166ms.
You can find some examples using this tehcnique in the repo .
This is the most basic type of race condition where vulnerabilities that appear in places that limit the number of times you can perform an action. Like using the same discount code in a web store several times. A very easy example can be found in or in .
Check this to try this.
Check this to see how to pay in a store and add an extra item you that won't need to pay for it.
According to Gitlab was vulnerable to a takeover this way because it might send the email verification token of one email to the other email.
Check this to try this.
Check this to try this.
There are several . Theses services will allow you to create an application and authenticate users that the provider has registered. In order to do so, the client will need to permit your application to access some of their data inside of the OAUth provider. So, until here just a common login with google/linkedin/github... where you are prompted with a page saying: "Application <InsertCoolName> wants to access you information, do you want to allow it?"
In you can find a PoC in Java to send websocket messages in parallel to abuse Race Conditions also in Web Sockets.
Learn & practice AWS Hacking: Learn & practice GCP Hacking:
Check the !
Join the 💬 or the or follow us on Twitter 🐦 .
Share hacking tricks by submitting PRs to the and github repos.
Use to easily build and automate workflows powered by the world's most advanced community tools. Get Access Today:
