Race Condition when following a user
业务逻辑 / Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') / #927384
该报告还没有中文解读。
原文摘录
摘自原文（1523 字符中的一小部分）
Summary: Hi team, There is a race condition vulnerability when following a user. If you send the `Follow` requests asynchronously, you can follow a user multiple times instead getting an error message. I've been using Turbo Intruder extension at Burp Suite for trying Race Condition attacks. I can …
原文中的代码
def queueRequests(target, wordlists):
engine = RequestEngine(endpoint=target.endpoint,
concurrentConnections=30,
requestsPerConnection=100,
pipeline=False
)
for i in …默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Staging.every.org 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @bugra · 版权归作者与 Staging.every.org 所有