James Kettle: Race Condition Attacks in Web Applications
A DEF CON 31 talk on new types of race condition vulnerabilities in web applications. The researcher shows how these attacks can break a site’s “state machine” — the logic that governs transitions between user and object states.
By sending multiple conflicting requests almost simultaneously, attackers can disrupt application logic: manipulating data, redirecting tokens, or hiding backdoors.
The talk also introduces a methodology for finding such vulnerabilities and tools that synchronize dozens of HTTP requests with millisecond precision.
By sending multiple conflicting requests almost simultaneously, attackers can disrupt application logic: manipulating data, redirecting tokens, or hiding backdoors.
The talk also introduces a methodology for finding such vulnerabilities and tools that synchronize dozens of HTTP requests with millisecond precision.