PORTSWIGGERN/ARace Conditions

Limit overrun race conditions

XESXOR9/2/20262 min read

#race conditions#portswigger#web-security-academy#race-conditions

Limit overrun race conditions

Platform: PortSwigger | Category: Race Conditions | Type: Lab | Difficulty: N/A | OS: N/A | Author: XESXOR | Date: 2026-08-24 | Status: Solved Techniques: Web Security Academy, Race Conditions

Summary

Walkthrough of the PortSwigger Web Security Academy lab Limit overrun race conditions (Race Conditions). This lab demonstrates a race conditions vulnerability and its exploitation to achieve the lab objectives.

Lab Overview

PortSwigger Web Security Academy — Race Conditions

This writeup is part of the XESXOR PortSwigger collection. The original lab description and solution have been preserved and reformatted for clarity.

Lab Description :

Solution :

The home page displays the promo code to avail 20% off that we can use at checkout.

Identify possible collision :

Add any cheap item to our cart . In this case I added High-End Gift wrapping to cart.

Now apply the coupon code , capture send the request to repeater.

Upon adding coupon code PROMO20, we see that we get the following response.

But upon sending the same request again, we see that the server responds with Coupon already applied.

Exploiting race window :

Assuming that there might be a race window between the application checking if coupon code is applied already/not. We can exploit it by using the single packet attack technique to send more number of packets at the same time to the server & executing all of it at the same time to exploit the race window.

To exploit,

Add the item to cart.
Send the request to repeater & click on custom actions tab at right side.
Click on New->From Template & select Trigger Race condition script.
Modify the number of requests to 1000.
<img width="1685" height="960" alt="image" src="https://github.com/user-attachments/assets/dc4a4943-4d75-43e2-8de0-dcc9d629d25e" />
Now run the script.

Observe that we can exploited the race window & now the price of the product is in negative. Similarly repeat the process using leather jacket & place the order to solve the lab

Key Takeaways / Lessons

Understanding Race Conditions detection and exploitation is crucial for web security.
Always validate and sanitize user input; implement proper access controls.
This lab is part of the PortSwigger Web Security Academy — practice in a safe, legal environment.

Crafted by XESXOR Research • 2026-08-24 • PortSwigger Web Security Academy • Lab: Limit overrun race conditions