The XSS Rat
CWAP · Module 11 — Business Logic

Attack 2 — Race conditions and TOCTOU

Animated, step-by-step: finding the gap between check and act, landing twenty requests inside it, and proving it was a race and not a retry.
Module 11Business logicTOCTOU / raceHigh
—

—

—

◤ Attacker workstation

🐀
you
idle
—

◤ On the wire

◤ Server

key material
—
waiting
attacker
server
hunter@cwap — bash
1× 0:00 / 0:00 step 1 / 1