Top 10 winner

Smashing the state machine: the true potential of web race conditions

James Kettle · PortSwigger Research · 9 August 2023

Web race conditions reach far beyond limit overrun: every HTTP request passes through hidden sub-states, so two requests landing in the same millisecond can force illegal state transitions, such as confirming an email address you do not own and hijacking Gitlab invitations. The single-packet attack completes 20 to 30 HTTP/2 requests in one TCP packet, removing network jitter.

Record

Researcher

James Kettle

Published by

PortSwigger Research

Date

9 August 2023

In the archive

• Ranked #1 in the 2023 Top 10 Web Hacking Techniques

Related sources

• Black Hat session
• Nullcon session
• Research implementation
• Benchmark and example scripts
• Foundational timeless timing research
• Protocol analysis follow-up
• Scanner methodology follow-up
• Talk recording
• Talk recording
• Talk recording

Tags

• race-condition
• toctou
• http2
• auth-bypass
• privilege-escalation
• rails
• tooling
• cve
• owasp-a01-2021
• owasp-a04-2021

This page is the archive's own catalogue record. The research is the work of James Kettle, first published at the original source. Preserved copies are kept so the citation survives its host.