# Lab: Limit overrun race conditions

## Predict a potential collision

After successfully starting the exercise, the shop should look something like the screenshot. We now log in with the user name `wiener` and the password `peter`. We access the login via the link "**My account**".

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2F5KG9HZ0ppMEr4JFMc6cV%2F1.png?alt=media&#x26;token=9da7f938-6891-479a-a58f-584f95dc97fc" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2FysLNmFAN5qsGpqvdE2Ti%2F6.png?alt=media&#x26;token=d274805f-330f-4c8f-8bfd-f470bb1405df" alt=""><figcaption></figcaption></figure>

After successful registration, we search the shop for the cheapest product so that we can study the sales process. It may be that a different product is the cheapest in your shop.

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2FSedyKTaBJQThrTIqF1vS%2F2.png?alt=media&#x26;token=10d1ae41-d71e-4e78-96fb-51242ae8922e" alt=""><figcaption></figcaption></figure>

We now add this product to our shopping basket. To do this, we click on ‘**View details**’ and go to the product page, if we scroll down here, we see the button ‘**Add to cart**’. By clicking on this button, we add the product to our shopping basket.

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2F5dWaOsKVOK8sJLW69wDE%2F3.png?alt=media&#x26;token=01246ccc-e01f-4a81-9d4e-9e8c092ad8c2" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2FjhJ1tZFNTwTCRTqB7Lg1%2F4.png?alt=media&#x26;token=91eec90e-c12f-40a9-bf73-a56e7f6e6b3f" alt=""><figcaption></figcaption></figure>

When we are on the start page of the shop, we can see in the top right-hand corner that there is now a product in our shopping basket. Click on the shopping basket to open it.

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2F1waSYgBGUsCglUVzSINo%2F5.png?alt=media&#x26;token=a83d54a9-4c58-4afd-96de-d9cc214eb3de" alt=""><figcaption></figcaption></figure>

The shopping basket should now contain the cheapest product. The shopping basket mechanism, and in particular the restrictions that determine what we can order, are worth trying to work around. The shopping basket should look like this:

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2FVTGzUdi9eoajENbBhJZj%2F7.png?alt=media&#x26;token=b40ee6fd-7771-4285-ab7d-a51a8293eef5" alt=""><figcaption></figcaption></figure>

Now we place a complete order. To do this, we enter the voucher code ‘**PROMO20**’ in the field provided and click on the ‘**Apply**’ button, then we have to click on the ‘**Place order**’ button to finalise the order.

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2FNrTJhIXPqfoxotzhs2vw%2F8.png?alt=media&#x26;token=78ea7aaa-4616-4ea2-afe3-7d325cd4d578" alt=""><figcaption></figcaption></figure>

After sending the order we receive the following message.

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2F9Cz0YKO8ImZmFGnzQ63h%2F9.png?alt=media&#x26;token=c204356f-865c-4901-b94c-3cf8cf86b009" alt=""><figcaption></figcaption></figure>

We now switch to the **Burp Proxy** and open the "**HTTP history**" there. In the "**HTTP history**" we search for all requests that enable interaction with the shopping basket. For example, the request `POST /cart` adds an item to the shopping basket. The request `POST /cart/coupon` adds a voucher code to the shopping basket.

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2FBKchxuYmvIWnMdbmxaB3%2F10.png?alt=media&#x26;token=d37644f5-c4d8-478c-abd0-bfda340d4638" alt=""><figcaption></figcaption></figure>

We send these two requests to the **Burp Repeater** in order to carry out some experiments. To do this, we move the mouse over the first request and press the right mouse button. A context menu opens in which we select the option "**Sent to Repeater**". We do the same with the second query.

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2F6GnNu4gSkKTnpH2qzd20%2F11.png?alt=media&#x26;token=064035f7-69f6-448b-b636-58b16c5742a4" alt=""><figcaption></figcaption></figure>

We can only apply the `POST /cart/coupon` request once to our basket, if we try to apply the coupon a second time we will get the following message in the **Response** section.

```
HTTP/2 302 Found
Location: /cart?couponError=COUPON_ALREADY_APPLIED&coupon=PROMO20
X-Frame-Options: SAMEORIGIN
Content-Length: 22

Coupon already applied
```

We now go back to the Burp Proxy and there to "**HTTP history**". Here we search for the request `GET /cart` and also send it to the Burp Repeater. Right-click on the request and select "**Send to Repeater**" in the context menu.

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2F9OiGyQ5yNhB0JpnH1yOe%2F12.png?alt=media&#x26;token=3b078f5b-2bb5-4424-869f-b639a2f77689" alt=""><figcaption></figcaption></figure>

In the Burp Repeater, we now send the `GET /cart` request twice to the application. The first time with the `Cookie` header and the second time without the `Cookie` header.

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2FGvpD6R83idZO1vDijzNd%2F13.png?alt=media&#x26;token=9d81a4da-a2aa-4a43-b9c2-aa593eade4ae" alt=""><figcaption></figcaption></figure>

Everything seems to be normal. We have a product in the shopping basket. Now we send the request without the `Cookie` header and see that the shopping basket is empty.

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2FGYEh46eB6OceG2QLMXSY%2F14.png?alt=media&#x26;token=b7954e69-4bfe-4838-b3ab-5b2e54513efc" alt=""><figcaption></figcaption></figure>

We can conclude from this that the status of the shopping basket is saved in our session on the server side and that all operations with the shopping basket are linked to our session ID or our user ID. It should be noted that there may be a time window between the time a discount code is first used and the time the database is updated to document the successful use of the discount code.

## Benchmark the behavior

We now make sure that there is no voucher code left in our shopping basket. To do this, we click on the "**Remove**" button in the shopping basket.

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2FMakiirh6tGM1QfnFeRwo%2F15.png?alt=media&#x26;token=fab71244-51f0-4992-a309-71b45a3ba96c" alt=""><figcaption></figcaption></figure>

Now we switch to the Burp Repeater and open the query `POST /cart/coupon`. We now create a new tab group by clicking on the "**+**" next to our requests in the Burp Repeater.

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2Fmv0GVpMApoFS9E5PUST3%2F16.png?alt=media&#x26;token=e0a57620-934f-4ee5-89c6-d33692690b23" alt=""><figcaption></figcaption></figure>

A menu will open where we select the option "**Create tab group**".

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2FExpmzPcgTgMDhPKK8QrX%2F17.png?alt=media&#x26;token=b2ee2b24-57c0-48c7-837b-465fd697fa41" alt=""><figcaption></figcaption></figure>

In the window that appears, we enter the group name "**RC-1**" and select the tab with the request `POST /cart/coupon`, in this example the query "**2**". We close the window by clicking on the "**Create**" button. Further information on creating tab groups can be found in the [Burp Suite documentation](https://portswigger.net/burp/documentation/desktop/tools/repeater/groups#creating-a-new-tab-group).

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2FA0Qh36posFOfIJ2gkHON%2F18.png?alt=media&#x26;token=036ad155-689a-4b23-9244-3633099feb41" alt=""><figcaption></figcaption></figure>

Now we right-click on a request in the group of tabs we have just created. A menu appears in which we select the option "**Duplicate tab**".

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2FyhhtHTV4MpP8JMARxtby%2F19.png?alt=media&#x26;token=25fcde23-e82f-4734-86c6-ddfd14604e01" alt="" width="185"><figcaption></figcaption></figure>

In the next menu we enter the number of tabs, in this exercise it is "**19**", and then click on "**Duplicate**". The new tabs are now automatically added to our "**RC-1**" group.

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2FbGdizJ6DvZOJ5OhmYbof%2F20.png?alt=media&#x26;token=705b3b71-6286-4dca-a172-434e3932b2f1" alt="" width="208"><figcaption></figcaption></figure>

Our tab group now contains 20 requests.

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2Fe5Q9wFS3jDZUrggOFiZO%2F21.png?alt=media&#x26;token=404069f6-6865-4340-a9d8-2a445361ddbd" alt=""><figcaption></figcaption></figure>

Now we want to send this group one after the other via separate connections. To do this, we click on the down arrow to the right of the "**Send**" button.

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2FwrCoYnMTmd1qFJlj1juo%2F22.png?alt=media&#x26;token=53e94a0b-280f-47f4-b2ac-db00a4fa260b" alt="" width="320"><figcaption></figcaption></figure>

In the menu we select the option "**Send group in sequence (separate connections)**".

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2ForkwBgYSKjBZEie4NGRC%2F23.png?alt=media&#x26;token=529a9eb1-7a63-4d0d-ba31-de7321ba92ac" alt="" width="323"><figcaption></figcaption></figure>

The "**Send**" button should now look like this:

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2FnXmDB5GKpdTowrStnmz5%2F24.png?alt=media&#x26;token=2da3bab9-fe7f-4d41-8bcf-4345a50e3cfd" alt="" width="290"><figcaption></figcaption></figure>

If you encounter problems, you can search for solutions in the [Burp Suite documentation](https://portswigger.net/burp/documentation/desktop/tools/repeater/send-group#sending-requests-in-sequence). We now start the attack by clicking on the "**Send group (separate connections)**" button. We see that the first response confirms that the coupon has been successfully applied, but all other responses reject the code with the same message "**Coupon already applied**". The following screenshot shows the response to the first request:

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2FruvwTsXnJCnObML76Qx8%2F25.png?alt=media&#x26;token=677be72c-e2d3-43d3-9747-5e01f3a56a36" alt=""><figcaption></figcaption></figure>

The responses to all other requests contain the message "**Coupon already applied**". As an example, here is the second request including the response:

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2FWUYpyC14RUUkNdLJtYye%2F26.png?alt=media&#x26;token=36849cd9-e058-4288-870e-edf29367dd5c" alt=""><figcaption></figcaption></figure>

## Probe for clues

We now switch to the browser and remove the coupon code from our shopping basket again.

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2FGmoSlx6LqTwUVTXVqqky%2F15.png?alt=media&#x26;token=f53a6f01-3a7d-4fbc-8a19-6cbcc9a731bc" alt=""><figcaption></figcaption></figure>

After removing the coupon code, we switch to Burp Repeater and change our attack from "**Send group in sequence (separate connections)**" to "**Send group in parallel (single-packet attack)**".

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2FCuz1q4jDeC1s6F7Xdy1x%2F22.png?alt=media&#x26;token=bc472928-9e05-4d07-ad5b-b958ac9095d7" alt="" width="320"><figcaption></figcaption></figure>

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2FvMdnBAbgqEgrC98Zpdz4%2F27.png?alt=media&#x26;token=07cd79c6-9f7f-4dd9-bd06-63f17ae2ca69" alt="" width="369"><figcaption></figcaption></figure>

Our button should now look like this:

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2FWIdWY7VcP9fzhwYaGzkp%2F28.png?alt=media&#x26;token=e06760dd-760e-4073-81c8-c0bd765f27b2" alt="" width="229"><figcaption></figcaption></figure>

If you have any questions about sending requests in parallel, you can consult the [Burp Suite documentation](https://portswigger.net/burp/documentation/desktop/tools/repeater/send-group#sending-requests-in-parallel). We start the attack by clicking on the "**Send group (parallel)**" button. If we now look at the responses of the various requests, we can see that several requests contain the message "**Coupon applied**" in their responses. This means that the voucher code has been applied to the shopping basket more than once. We can confirm this in the browser:

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2FoZw6l1Ak1DWWndqNAzgp%2F29.png?alt=media&#x26;token=9fd12944-2a6c-43c9-b2cc-cfac42852a3f" alt=""><figcaption></figcaption></figure>

As you can see, the discount for our order is $0.74, so we have received a discount of well over 20%. If you get a different result or no result at all, remove the voucher code from your shopping basket and try again.

## Prove the concept

Now we want to buy the "**Lightweight ‘l33t’ Leather Jacket**". To do this, we switch to the browser and remove the product from the shopping basket. Now we add the "**Lightweight ‘l33t’ Leather Jacket**" to our shopping basket.

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2FTkaFDKkke0ZiEVE5kmuC%2F30.png?alt=media&#x26;token=f31794bf-7a71-4c5f-8e95-137417aa9e27" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2FqFNBtS5VInW3zGxE2xbK%2F31.png?alt=media&#x26;token=4074a880-3c7f-416c-a204-f610a792c224" alt=""><figcaption></figcaption></figure>

Now we switch to the Burp Repeater and start our attack by clicking on the "**Send group (parallel)**" button. If we now look at the responses to the various requests, we can see that several requests contain the message "**Coupon applied**" in their responses. This means that the coupon code has been applied to the shopping basket more than once. If we now switch to the browser and refresh our shopping basket, we can see how many times the coupon code has been applied.

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2FiV2XcPcnG4pRCMewzPJm%2F32.png?alt=media&#x26;token=04ac7a81-60a6-4d99-9fd5-d28688b2db64" alt=""><figcaption></figcaption></figure>

We now click on the "**Place order**" button and have completed the exercise.

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2Ff43AgKsiqh68nHp24vUy%2F33.png?alt=media&#x26;token=bc61cc80-ea20-4f99-b6a7-2b12e1cb5510" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
It may well take a few attempts to solve this exercise. Simply remove the coupon code from your shopping basket and start the attack again.
{% endhint %}

## Video solution

{% embed url="<https://youtu.be/dh8_IkDWk3Y>" %}
