Smashing The State Machine: The True Potential Of Web Race Conditions
summary
A precise exploit technique called the single packet attack packs ~20–30 HTTP requests into one TCP packet to eliminate network jitter; benchmarks from Melbourne→Dublin (177,000 km) show last-byte sync median spread ~4 ms (std 3) versus the single-packet median spread 1 ms (std 0.3), making remote races behave like local ones. An open-source implementation in turbo Intruder and Burp’s repeat-tab works; it finds Devise/GitLab email-token misrouting that can hijack pending invites, and free Web Security Academy labs and tooling are available.
AI-written summary · about
chapters (22)
- 0:00Introduction
- 0:50What are race conditions
- 3:12Agenda
- 3:59The True Potential
- 8:05The Single Packet Attack
- 10:16Why Its Special
- 11:31Performance
- 13:16Summary
- 14:40Less collision potential
- 15:23Probe for clues
- 17:18Example
- 19:19Classic Multistep Attack
- 20:26Changing Email Address
- 21:46Lining The Race Window
- 22:25Live Demo
- 31:09Misrting
- 32:30Partial Construction Attacks
- 33:28Data Structures Locking Strategies
- 35:29Automated Detection Of Race Conditions
- 38:20Application To Other Protocols
- 40:22Defence
- 42:07Questions
related talks
38mSmashing the State Machine: The True Potential of Web Race Conditions
50mHTTP Desync Attacks: Smashing into the Cell Next Door
45mHTTP Desync Attacks: Smashing Into The Cell Next Door
32mLearn to Exploit TOCTOU Race Condition Vulnerabilities with OWASP TimeGap Theory
48mHTTP Desync Attacks: Request Smuggling Reborn
55mAttacking Modern Web Technologies
50mTime Trial: Racing Towards Practical Timing Attacks
21mOff-Path TCP Exploit: How Wireless Routers Can Jeopardize Your Secrets