# Lab: Single endpoint race conditions

## Predict a potential collision

After starting the exercise, the shop should look like the screenshot. We click on the ‘**My account**’ link at the top right.

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2FNoyPkrdgS2aAexFU8PNI%2F1.png?alt=media&#x26;token=3daf240c-5101-4b0f-90de-6e6011168ba3" alt=""><figcaption></figcaption></figure>

In the login window we enter our user name `wiener` and the password `peter` and click on the button ‘**Log In**’.

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2FgSgegmh7je4G9xFYoyMm%2F2.png?alt=media&#x26;token=8a1de68c-1a9f-4487-ac3d-3cbfa758d050" alt="" width="375"><figcaption></figcaption></figure>

In our account, we now try to change our e-mail address. To do this, we enter any address in the ‘**Email:**’ field in the following form:

```
hacker1@exploit-0a5600b00428f10380b852da01410025.exploit-server.net
```

{% hint style="info" %}
Email

**DON'T FORGET!** The domain **exploit-0a5600b00428f10380b852da01410025.exploit-server.net** is a different one for you.
{% endhint %}

After we have entered the new email address, we send the form by clicking on ‘**Update email**’.

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2FI03xCnwEK7Pi5i0Ni3pm%2F3.png?alt=media&#x26;token=85c20fc7-4ca1-46a2-840b-e73a82cca581" alt="" width="375"><figcaption></figcaption></figure>

We now receive the message ‘**Please click on the link in your email to confirm the change of email: <hacker1@exploit-0a5600b00428f10380b852da01410025.exploit-server.net>**’.

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2FU9aMziQ3AMqFjHOIuqIf%2F4.png?alt=media&#x26;token=3e253c7d-1997-4219-831e-86973830c965" alt="" width="375"><figcaption></figcaption></figure>

To be able to click on the link, we need to switch to our email client. To do this, we click on the ‘**Email client**’ button at the top.

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2FgyKqCq62U2WBeK8vz9ia%2F5.png?alt=media&#x26;token=778a44c1-7a21-431a-966d-5fb3833fbde1" alt=""><figcaption></figcaption></figure>

Our mailbox now contains the e-mail about our change of address. If we click on the ‘**View raw**’ link on the far right, we can view the content of the email.

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2FnZN0cgAFvwhRop7c4VQO%2F6.png?alt=media&#x26;token=13799249-85bd-4b55-b6e5-0fb2ea9d26ae" alt=""><figcaption></figcaption></figure>

Now we can examine the content of the mail more closely. We notice that there is a unique token in **line 7**.

```html
Sent:     2025-03-15 07:07:03 +0000
From:     no-reply@0a5c004604e4f1ea803953ed00a70001.web-security-academy.net
To:       hacker1@exploit-0a5600b00428f10380b852da01410025.exploit-server.net
Subject:  Please confirm your e-mail

<p>To confirm your email change to hacker1@exploit-0a5600b00428f10380b852da01410025.exploit-server.net, click the link below</p>
<a href="https://0a5c004604e4f1ea803953ed00a70001.web-security-academy.net/confirm-email?user=wiener&token=BKnqcpIIl52v4P1H">
    Click here to confirm.
</a>
```

We now return to our mailbox and click on the link ‘**Click here to confirm**’ to confirm the change of address.

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2FBdQAu148hHMslFU9TiFS%2F7.png?alt=media&#x26;token=eaa406ff-b63c-4194-aa6a-b92898b1d575" alt=""><figcaption></figcaption></figure>

We receive the message ‘**Your email has been successfully updated**’ and see in ‘**My Account**’ that our new email address has been entered.

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2FnFurTHHdytbo1OS8nyZR%2F8.png?alt=media&#x26;token=e6550d06-7877-402e-b9cd-77f125e09071" alt="" width="375"><figcaption></figcaption></figure>

We now change our e-mail address twice more to study the behaviour of the address change more closely. The first new address is:

```
hacker2@exploit-0a5600b00428f10380b852da01410025.exploit-server.net
```

Fill in the form and send it off.

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2FvqvWz5Gt26RDiMFWPTYc%2F9.png?alt=media&#x26;token=62b09d9f-9716-464a-ae75-e81db4e5d9df" alt="" width="375"><figcaption></figcaption></figure>

The change has been sent successfully.

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2FOozoU8jdTbyDc1kPpj61%2F10.png?alt=media&#x26;token=40f39a64-5609-403c-870e-1a0502f9a942" alt="" width="375"><figcaption></figcaption></figure>

{% hint style="info" %}
Do not switch to the email client and click on the confirmation link!
{% endhint %}

The second address is:

```
hacker3@exploit-0a5600b00428f10380b852da01410025.exploit-server.net
```

Fill in the form and send it off.

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2FgFIOzO8w51gIFycaxGW2%2F11.png?alt=media&#x26;token=f9c20453-38fd-406b-959b-6aa7b26dc5ba" alt="" width="375"><figcaption></figcaption></figure>

The change has been sent successfully.

Now we switch to our mail client and take a closer look at the confirmation emails we have received.

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2Fc3PMO41FK1HzptUpKnK5%2F5.png?alt=media&#x26;token=85b39678-cdd6-48b4-960b-2fb926781bb3" alt=""><figcaption></figcaption></figure>

As we can see, we have received the two confirmation emails in our mailbox.

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2FbIabqbVHpkELwHu1Hq5T%2F12.png?alt=media&#x26;token=40d32c52-2e07-4427-af6f-e72464ead28d" alt=""><figcaption></figcaption></figure>

Now we click on the link ‘**Click here to confirm**’ in the second email from above. The recipient of the email is **hacker2**. We receive the message ‘**This link is invalid**’, which means that the activation link is no longer valid and can therefore no longer be used. From this we can conclude that the website only stores one outstanding email address at a time. Since the transmission of a new e-mail address means that this entry is processed in the database and not supplemented, collisions may occur. We click on the confirmation link of the first email, the recipient is ‘**hacker3**’ and then click on the link ‘**My account**’, there we see our new email address <hacker3@exploit-0a5600b00428f10380b852da01410025.exploit-server.net>.

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2FkPEaywyqVPRTDu8EgxNd%2F13.png?alt=media&#x26;token=ac10939c-3664-4e97-a11f-64db4530a9d9" alt="" width="375"><figcaption></figcaption></figure>

## Benchmark the behavior

We now switch to the **Burp Proxy** and open the ‘**HTTP history**’ tab. In the ‘HTTP history’ we search for a `POST` request to the endpoint `/my-account/change-email`.

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2F38uOSeZcyoVyaygXEDDq%2F14.png?alt=media&#x26;token=8dbe3824-bbfa-43ca-a329-97ac56cee2b3" alt=""><figcaption></figcaption></figure>

We now send this request to the **Burp Repeater**. To do this, we move the mouse over the request and press the right mouse button. A context menu appears in which we select the option ‘**Send to repeater**’.

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2FYQ8nc6v8YiQXm8jaiFEd%2F15.png?alt=media&#x26;token=059c1707-8525-4e2c-81ee-a0167c56dfa4" alt="" width="215"><figcaption></figcaption></figure>

Now we switch to the Burp Repeater and create a tab group there. To do this, we click on the plus sign next to the tab and select the option ‘**Create tab group**’.

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2FcVz4x6tWlmRjAubq7wd5%2F16.png?alt=media&#x26;token=110555df-120a-4f87-94b5-112bf0f72c39" alt="" width="325"><figcaption></figcaption></figure>

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2F5QzmgN7cHgc4nQ7QEwKO%2F17.png?alt=media&#x26;token=148be298-28e9-4993-82f1-4144d8ddcae4" alt="" width="145"><figcaption></figcaption></figure>

A window appears in which we enter a name for the tab group, here ‘**RC-4**’ is used as the name. The first and only tab is selected in the second section. We then click on the ‘**Create**’ button.

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2F8y0XrFTjdv3PP0u0aYQf%2F18.png?alt=media&#x26;token=cf40b010-3887-416a-a4df-8a78ae7e52bc" alt="" width="366"><figcaption></figcaption></figure>

Now we right-click on the tab in our tab group and select the ‘**Duplicate tab**’ option.

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2FRuoFWXIZt3OhDS1uk04L%2F19.png?alt=media&#x26;token=b72973c4-443e-4ecd-9ae0-3908d755f40f" alt="" width="187"><figcaption></figcaption></figure>

In the window, we specify how often we want to duplicate the tab. We enter ‘**19**’ there.

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2FUyjX8asM2A0VmMtiBqpK%2F20.png?alt=media&#x26;token=240c446c-e3ce-4366-a707-28ac2ccfcd21" alt="" width="208"><figcaption></figcaption></figure>

If you need more information about creating tab groups, you can find it in the [Burp Suite documentation](https://portswigger.net/burp/documentation/desktop/tools/repeater/groups#creating-a-new-tab-group).

The tab group should now look like this.

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2Fe82qJRP8aGNdVVCvGmfe%2F21.png?alt=media&#x26;token=64d4d22b-ce6f-43fd-b363-f4a0c3230f00" alt="" width="328"><figcaption></figcaption></figure>

Now we need to adjust the email address in all tabs. We will use the name `test` plus a number starting with `1`. The first mail address would therefore look like this:

```
test1@exploit-<YOUR-EXPLOIT-SERVER-ID>.exploit-server.net
```

The second e-mail address would then be:

```
test2@exploit-<YOUR-EXPLOIT-SERVER-ID>.exploit-server.net
```

The last e-mail address would then be:

```
test20@exploit-<YOUR-EXPLOIT-SERVER-ID>.exploit-server.net
```

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2FIFYxfaS9NItjNH8IEVun%2F22.png?alt=media&#x26;token=c1faad5a-b66a-4987-9e5e-c463e12ec404" alt=""><figcaption></figcaption></figure>

We now configure the Burp Repeater so that we send the requests in the ‘**RC-4**’ tab group to the application one after the other via separate connections. To do this, we click on the down arrow next to the ‘**Send**’ button.

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2FsTIWdvBezk9lQutQIfqo%2F23.png?alt=media&#x26;token=a2e3a3f7-79f7-444a-bb01-253485cd7a92" alt="" width="322"><figcaption></figcaption></figure>

There we select the option ‘**Send group in sequence (separate connections)**’.

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2FhDIAJHuKTaw7E0SBS0eV%2F24.png?alt=media&#x26;token=65624f51-0652-4ece-b077-373d0764730f" alt="" width="318"><figcaption></figcaption></figure>

The ‘**Send**’ button should now look like this:

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2Frm6kS30VpDCoJJButkee%2F25.png?alt=media&#x26;token=5dddc20f-b14d-4678-af67-b256790dfafa" alt="" width="375"><figcaption></figcaption></figure>

We now send the tab group by clicking on the ‘**Send group (separate connections)**’ button and switch to our e-mail client.

If you need more information about sending requests via separate connections, you can find it in the [Burp Suite documentation](https://portswigger.net/burp/documentation/desktop/tools/repeater/send-group#sending-requests-in-sequence).

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2FgPHWmCFQ3KpktDn3ydua%2F26.png?alt=media&#x26;token=13ac0f69-005d-4f7e-977b-6c5129bb18c4" alt=""><figcaption></figcaption></figure>

In the e-mail client, we can see that we have received a confirmation e-mail for each new e-mail address.

## Probe for clues

Now we switch back to Burp Repeater and change the way the requests are to be sent to parallel sending. Further information on parallel sending can be found in the [Burp Suite documentation](https://portswigger.net/burp/documentation/desktop/tools/repeater/send-group#sending-requests-in-parallel).

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2FwTD1o7XfE7MTqmgJwVIK%2F27.png?alt=media&#x26;token=9e97bdad-d87c-471e-8f6a-64f2b2ef8a40" alt="" width="365"><figcaption></figcaption></figure>

We now send the tab group with the option ‘**Send group in parallel (single-packet attack)**’. After sending, we switch to our email client and analyse the received confirmation emails. We notice that there are differences between the recipients of the mail and the tokens sent. For example, the user `test4` receives the token from the user `test1`.

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2FmIiLbITYBJv1tt4Ay5FU%2F28.png?alt=media&#x26;token=e602fa7e-cae2-46ae-bac8-e3cf937962c4" alt=""><figcaption></figcaption></figure>

Let us now consider that there may be a time window in which the website is called up, triggering a task that ultimately sends an email to the specified address. Data is retrieved from the database and used to render the email template. If a parallel request during this time window changes the pending email address stored in the database, this will result in confirmation emails being sent to the wrong address.

## Prove the concept

We now switch to the Burp Repeater and remove all but two tabs from the group.

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2F5yQ0sN6NngtYw5DwSb84%2F29.png?alt=media&#x26;token=61f56f2f-5c6b-4fe9-bbba-c6eb01a2ef35" alt="" width="248"><figcaption></figcaption></figure>

In the first enquiry we change the email address to:

```
anything@exploit-<YOUR-EXPLOIT-SERVER-ID>.exploit-server.net
```

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2FBye3H582Esi7P2keY9qU%2F30.png?alt=media&#x26;token=c4ab7a5a-2dff-4006-9f91-d48f92acf1ba" alt=""><figcaption></figcaption></figure>

In the second enquiry we change the email address to:

```
carlos@ginandjuice.shop
```

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2FlGmSPwNySZWNc0S0Db0Q%2F31.png?alt=media&#x26;token=22020f22-e64d-44f3-a77e-d4f72bb001a3" alt=""><figcaption></figcaption></figure>

We now send these requests in parallel by clicking on the ‘**Send group in parallel (single-packet attack)**’ button. We then switch to our e-mail client and check the received confirmation e-mail. If the body of the mail contains the address `anything@exploit-<YOUR-EXPLOIT-SERVER-ID>.exploit-server.net`, we switch to the Burp Repeater and start the attack again.

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2FsFjQp9Qd1pq9tIZ9Wm5i%2F32.png?alt=media&#x26;token=3badd94b-3dd3-4146-92e1-7649d3091c32" alt=""><figcaption></figcaption></figure>

If the address `carlos@ginandjuice.shop` is present in the body of the mail, then we click on the link ‘**Click here to confirm**’.

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2FRz1QvoeiEBD0i0HhwFZ9%2F33.png?alt=media&#x26;token=ba0d1571-080a-471a-8d37-856405898502" alt=""><figcaption></figcaption></figure>

We then receive the message ‘**Your email has been successfully updated**’ and now switch to our account by clicking on the link ‘**My account**’. We have successfully changed the email address to `carlos@ginandjuice.shop` and now have access to the ‘**Admin panel**’. We now click on this link.

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2F8MYOv6oCn7MMDTRKybZG%2F34.png?alt=media&#x26;token=00f56760-30bb-451d-a97a-3f8e276c4db4" alt=""><figcaption></figcaption></figure>

The aim of this exercise is to delete the user **carlos**. We now do this by clicking on the ‘**Delete**’ link next to the user name **carlos**.

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2FXON1CUX64LXbFkOWebUP%2F35.png?alt=media&#x26;token=70edc800-5f89-4360-997a-8602bf19b1d5" alt=""><figcaption></figcaption></figure>

The exercise was successfully completed.

<figure><img src="https://2110960218-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT20JLnRLUo41Hn13Y9PL%2Fuploads%2FudIAzAMWm7d9Wop91avu%2F36.png?alt=media&#x26;token=5d38b1c7-3adf-41be-8776-8cfc4c86259a" alt=""><figcaption></figcaption></figure>

## Video solution

{% embed url="<https://youtu.be/MEDT1Hf0aYg>" %}
