Top 10 winner
Smashing the state machine: the true potential of web race conditions
Web race conditions reach far beyond limit overrun: every HTTP request passes through hidden sub-states, so two requests landing in the same millisecond can force illegal state transitions, such as confirming an email address you do not own and hijacking Gitlab invitations. The single-packet attack completes 20 to 30 HTTP/2 requests in one TCP packet, removing network jitter.
Record
- Researcher
- James Kettle
- Published by
- PortSwigger Research
- Date
- Topic
- Other
In the archive
Related sources
- Black Hat session
- Nullcon session
- Research implementation
- Benchmark and example scripts
- Timeless Timing Attacks: Exploiting Concurrency to Leak Secrets over Remote Connections
- The single-packet attack: making remote race-conditions 'local'
- How to build custom scanners for web security research automation
- Nullcon Goa 2023 | Smashing The State Machine: The True Potential Of Web Race Conditions by James
- DEF CON 31 - Smashing the State Machine the True Potential of Web Race Conditions - James Kettle
- Smashing the State Machine: The True Potential of Web Race Conditions
Tags
This page is the archive's own catalogue record. The research is the work of James Kettle, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .