Multi endpoint race conditions

Description

This lab's purchasing flow contains a race condition that enables you to purchase items for an unintended price.

To solve the lab, successfully purchase a Lightweight L33t Leather Jacket.

You can log into your account with the following credentials: wiener:peter.

Approach

Upon logging in, I opted to utilize the gift card product to test the purchase process, given its redeemable nature. Examining the HTTP history in Burp Suite revealed a POST /cart request responsible for adding items to the cart, followed by a POST /cart/checkout request for payment processing. I then utilized Burp Repeater to send both requests in sequence, grouped under a single connection. An observable gap in processing time between the requests became evident:

To address this latency issue, I initiated an inconsequential request, such as a GET /, to warm up the connection before proceeding with the actual requests. Upon rectifying this issue, I attempted to modify the product ID to 1, corresponding to the leather jacket, but encountered a failure due to insufficient funds:

Subsequently, I manually removed the leather jacket from the cart and added a gift card instead. Retaining the product ID as 1 for the leather jacket, I altered the attack strategy to a single-packet attack, wherein groups are sent in parallel:

Breaking down the process, the cart now contains only a gift card, bypassing the payment step during group transmission. Leveraging parallel requests, I added the leather jacket immediately after payment verification, successfully purchasing the item and solving the lab.