Smashing the State Machine: The True Potential of Web Race Conditions
summary
Introduces the single packet attack implemented as a Turbo Intruder update that sends 20–30 requests in one packet so servers process them within a median ~1 ms spread (vs ~4 ms for last byte sync), making remote races behave like local ones; reproduces a GitLab/Devise email-token misrouting (verified email hijack) in ~30 seconds versus ~2 hours previously, outlines a predict / probe / proof methodology, and reports GitLab patched while Devise remains awaiting fixes.
AI-written summary · about
chapters (18)
- 0:00Web race condition vulnerabilities
- 3:14Limit overrun races in the wild
- 6:04Race condition attacks potential
- 8:40Single packet attack intro
- 11:50Benchmarking single packet attack
- 12:11Finding race conditions method
- 15:59GitLab email verification flaw
- 21:02GitLab exploit demo
- 26:20GitLab vulnerability code
- 28:46Devise framework vulnerabilities
- 30:09Email change race conditions
- 31:16Detecting race condition anomalies
- 31:38Partial construction vulnerabilities
- 32:44Root causes of race conditions
- 35:15Improving single packet attack
- 36:19Defending substate race conditions
- 37:24Key takeaways
- 37:45Q&A
related talks
44mSmashing The State Machine: The True Potential Of Web Race Conditions
32mLearn to Exploit TOCTOU Race Condition Vulnerabilities with OWASP TimeGap Theory
50mHTTP Desync Attacks: Smashing into the Cell Next Door
55mAttacking Modern Web Technologies
45mHTTP Desync Attacks: Smashing Into The Cell Next Door
01h 02mPrompt-Jacking: The Rise of a New Supply Chain Risk
50mTime Trial: Racing Towards Practical Timing Attacks
40mThe Mechanisms That Enable Misuse and What We Can Do About It