I have recently identified RACE condition vulnerability in Bug bounty program.
A race condition attack happens when a computing system that’s designed to handle tasks in a specific sequence is forced to perform two or more operations simultaneously. Eventually, the application is forced to perform unintended actions. This leads the application to security exploitation.
Please check below links to get to know more about this bug:
A race condition attack happens when a computing system that's designed to handle tasks in a specific sequence is…
Normally, the admin user is authorized to create ONLY 3 three members in his/her team. However, I have successfully managed to create 4 team members using RACE condition vulnerability.
Steps that I followed:
- Click on add team member request and captured the request using burp suite
2.” E-mail and name” have been taken as the parameter and used for race condition attack.
3. Next, we need to configure the intruder options to stimulate RACE condition attack. First, we need to provide the parameter values as shown in the screenshot.
3. Now, we need to make changes to the number of threads for execution. It is highly crucial because it will speed up sending the requests to the server.
4. Now click on “Start attack” in intruder option. Burp will initiate sending requests simultaneously to the server. As a result of this attack, I was successfully able to add 4 team members. Now, totally I have 4 team members in my team.
If you like the blog, please share and like it.
If you like the content, please follow me on medium and LinkedIn