Exploiting Time-sensitive Vulnerabilities

Опубликовано: 29 Январь 2024
на канале: Intigriti

2,204

👩‍🎓👨‍🎓 Learn about Race Condition vulnerabilities and how to exploit them! This lab contains a password reset mechanism. Although it doesn't contain a race condition, we can exploit the mechanism's broken cryptography by sending carefully timed requests. To solve the lab, we need to identify the vulnerability in the way the website generates password reset tokens, obtain a valid password reset token for the user carlos, log in as carlos, access the admin panel and delete the user carlos.

Overview:
0:00 Intro
0:09 Exploiting time-sensitive vulnerabilities
0:43 Lab: Exploiting time-sensitive vulnerabilities
1:19 Explore password reset functionality
2:57 Bypass the per-session locking restriction
4:43 Exploit timing issue to reset password
6:44 How to prevent race condition vulnerabilities
8:09 Conclusion

If you're struggling with the concepts covered in this lab, please review https://portswigger.net/web-security/... 🧠

🔗 Portswigger challenge: https://portswigger.net/web-security/...

🧑💻 Sign up and start hacking right now - https://go.intigriti.com/register

👾 Join our Discord - https://go.intigriti.com/discord

🎙️ This show is hosted by / _cryptocat ( ‪@_CryptoCat‬ ) & / intigriti

👕 Do you want some Intigriti Swag? Check out https://swag.intigriti.com