40 lines
1.4 KiB
Bash
Executable File
40 lines
1.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Vector 19: Race Condition
|
|
# Desc: TOCTOU, concurrent request race conditions
|
|
# Detect: Coupon codes, transfers, voting, limited-use operations
|
|
# Severity: MEDIUM
|
|
# Tools: curl
|
|
|
|
vector_race() {
|
|
local target="$1"
|
|
local report="$2"
|
|
local findings=0
|
|
|
|
print_info "Testing Race Condition vectors..."
|
|
|
|
# Look for potential race targets
|
|
local page=$(curl -s --connect-timeout 5 --max-time 10 "$target" 2>/dev/null)
|
|
local race_indicators=""
|
|
|
|
echo "\$page" | grep -qiE "coupon|discount|promo|free trial|voucher|transfer|withdraw|claim|vote|review|submit" && race_indicators="yes"
|
|
|
|
if [ -n "$race_indicators" ]; then
|
|
# Find endpoints to race
|
|
local endpoints=$(echo "$page" | perl -nle 'print \$1 while /(action="[^"]*"|href="[^"]*")/g' | grep -iE "submit|claim|redeem|transfer|vote" | head -3)
|
|
|
|
if [ -n "$endpoints" ]; then
|
|
print_warn "Potential race condition targets found - manual testing recommended"
|
|
print_info "Send multiple concurrent requests to the same endpoint"
|
|
|
|
echo "SEVERITY: MEDIUM
|
|
VECTOR: Potential Race Condition
|
|
DETAIL: Possible race condition targets on $target
|
|
EVIDENCE: State-changing operations detected: coupon/claim/vote/transfer
|
|
EXPLOIT: Send 50+ concurrent requests: for i in {1..50}; do curl -X POST [endpoint] & done" > "$REPORTS_DIR/.finding_$(date +%s)_race.txt"
|
|
findings=$((findings + 1))
|
|
fi
|
|
fi
|
|
|
|
return $findings
|
|
}
|