Winning race conditions

Race conditions occur when an action is being performed on the same data in a multiple threaded web application. It basically produces unexpected results when the timing of one action being performed will impact the other action.

Some examples of an application with the race condition vulnerability can be an application that allows transfer of credit from one user to another or an application that allows a voucher code to be added for a discount that can also have a race condition, which may allow an attacker to use the same code multiple times.

How to do it...

We can perform a race condition attack using Burp's Intruder as follows:

1. We select the request and click on Send to Intruder:

2. We switch to the Options tab and set the number of threads we want, 20 to 25 are good enough usually:

3. Then, in the Payloads tab, we choose Null payloads in Payload type as we want to replay the same request:

4. Then, in the Payload Options, we choose the number of times we want the request to...