Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Concurrency exploits: The ultimate Bug Bounty guide to exploiting race condition vulnerabilities in web applications

yeswehack.com | blog | #bug-bounty | #cloud | #burp-suite | #http2 | #turbo-intruder | #race-condition | #concurrency

Summary

A 'Vulnerability Vectors' deep dive into race conditions: last-byte synchronisation and HTTP/2 single-packet attacks, exploiting with Burp Suite Turbo Intruder, plus CVEs and mitigations.
Published
Collected

original ↗

Related coverage

  1. Turbo Intruder: Embracing the billion-request attack (portswigger.net)
  2. YesWeHack joins G-Cloud framework for UK public-sector procurement after clearing rigorous evaluation (yeswehack.com)
  3. Racing against time: An introduction to race conditions (bugcrowd.com)
  4. Cracking reCAPTCHA, Turbo Intruder style (portswigger.net)
  5. Neo v1 is now available for everyone (projectdiscovery.io)
  6. Ghost-Js-Burp-Extension: Burp Suite Extension to Detect Hardcoded Secrets & Endpoints in JavaScript (github.com)

back