PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Concurrency exploits: The ultimate Bug Bounty guide to exploiting race condition vulnerabilities in web applications

yeswehack.com | blog | #bug-bounty | #cloud | #burp-suite | #http2 | #turbo-intruder | #race-condition | #concurrency
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A 'Vulnerability Vectors' deep dive into race conditions: last-byte synchronisation and HTTP/2 single-packet attacks, exploiting with Burp Suite Turbo Intruder, plus CVEs and mitigations.
Published
Collected

Related coverage

blog · bugcrowd.com
Racing against time: An introduction to race conditions
Race condition exploits abuse the split-second gap between check and action. This intro covers race windows and limit overrun, which bypasses one-per-user purchase limits with concurrent requests.
blog · hackenproof.com
Inside American Express India's Cloud Storage Exposure
An open MongoDB exposed 3M American Express India records, including Aadhaar and PAN numbers. What happened, and does Amex run a bug bounty today?
research · portswigger.net
Turbo Intruder: Embracing the billion-request attack
James Kettle introduces Turbo Intruder, a research-grade Burp Suite extension built for speed, enabling billion-request attacks, multi-day brute-force and race-condition exploitation.
research · portswigger.net
Cracking reCAPTCHA, Turbo Intruder style
James Kettle uses Turbo Intruder's last-byte synchronization to trigger a race condition that partially bypasses Google reCAPTCHA, demonstrated against Reddit after Google declined to fix it.
blog · yeswehack.com
Dojo challenge #47 APICrash solution
Dojo #47: a race condition in a threaded TinyDB update inside a GraphQL backend triggers errors whose messages leak the flag — a classic information-exposure-through-error-message bug.
blog · yeswehack.com
Ultimate double-clickjacking exploit, novel HTTP/2 request tunnelling techniques, when encryption makes matters worse – ethical hacker news roundup
Roundup: an 'ultimate' double-clickjacking PoC with a fake Cloudflare Captcha and Flappy Bird, underrated HTTP request tunnelling attacks, and a critical OpenPGP.js signature spoofing flaw.
Back