Limit overrun race conditions

Description

This lab's purchasing flow contains a race condition that enables you to purchase items for an unintended price.

To solve the lab, successfully purchase a Lightweight L33t Leather Jacket.

You can log in to your account with the following credentials: wiener:peter.

Approach

Upon entering the lab, I immediately delved into the purchasing flow, eager to explore its intricacies. With my proxy enabled to scrutinize every request in Burp Suite, I embarked on a journey to uncover any vulnerabilities lurking within the system.

A crucial limitation emerged during my investigation: the system restricted coupon usage to a single redemption per user. This revelation sparked an idea – if I could exploit this limitation, I might gain an advantage in the purchasing process.

With a plan in mind, I prepared to execute a parallel attack. My objective was clear: manipulate the coupon redemption process to secure items at an unintended price point. Armed with this strategy, I meticulously crafted a series of requests to bombard the system simultaneously.

For those unfamiliar with the shortcut, sending a request to Repeater is as easy as pressing CTRL+R.

Now, all I have to do is navigate to Repeater, click on the "+" button, and select "Create Tab Group." From there, I can choose the necessary requests for my group.

Finally, all I had to do was select the "Send in Parallel" option in Repeater, and just like that, the coupon was applied multiple times. As a result, the price dropped, allowing me to purchase the leather jacket and complete the lab.