webPromedium
Lab 272 — SwiftMart — Race Condition in Promo Code Redemption
hackadvisor
Task: Digital marketplace with wallet system where each user gets a single-use $50 promo code, but premium vault items cost $500+. Solution: TOCTOU race condition on promo code redemption endpoint — fire 200 concurrent requests using threading.Barrier to redeem the same code multiple times before it's marked as used, inflating wallet balance to purchase the vault item containing the flag.
$ ls tags/ techniques/
flaskrace_conditiontoctouconcurrent_requeststhreadingsession_cookiesdecoy_flagpromo_codewalletdigital_marketplace
race_condition_exploitationthread_barrier_synchronizationsession_cookie_sharingtoctou_promo_bypassconcurrent_http_flooding
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 14 — SoundMart — Race Condition in Coupon Redemption— hackadvisor
- [web][Pro]Точка невозврата (Point of No Return)— hackerlab
- [web][Pro]Race Shop— web-kids20
- [web][Pro]Race Shop 2— web-kids20
- [web][Pro]Lab 162 — VaultDrop — File Upload Race Condition (TOCTOU)— hackadvisor