> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/race-conditions/race-conditions-that-bypass-limits.md).
# 绕过限制的竞态条件
### 限制超限竞态条件
购买流程包含一个 **竞态条件** 从而让你获得一个 **意外价格** 在付款时。
#### 目标
成功购买 **轻量级 L33t 皮夹克**.
#### 数据 / 前提条件
* 凭据： `wiener:peter`
* 折扣码（20%）： `PROMO20`
* 可用余额： **$50**
* 夹克价格： **$1300**
### 行为观察
1. 将夹克加入购物篮。
2. 应用 `PROMO20` 优惠券。
3. 如果你尝试第二次应用优惠券，应用程序会响应： **优惠券已应用**.
优惠券应用请求如下（表单 URL 编码）：
```bash
csrf=7QYFGBaACc8P5YOfUHR4S85oo95uA0Vb&coupon=PROMO20
```
### 手动利用（Burp Repeater）
1. 将应用请求发送到 **重放器**.
2. 创建一个 **组** 在 Repeater 中。
* 将请求标签页复制约 20 次（**复制标签页**).
发送请求 **并行地**.
结果是大多数请求都被 **验证通过**，总计变为 **/\~37**，即使原价（1300 美元）和有限额度，也能让你成功购买。
### 自动化利用（Burp Suite Pro 自定义操作）
实验建议使用 **触发竞态条件** （Burp Suite Professional）通过 **自定义操作**.
#### 1）添加脚本（Bambda 库）
前往 **扩展 → Bambda 库** 并添加：
* **id**: `eb57d5bd-33e2-4a8c-bf51-bc81bd26613a`
* **name**: `探测竞态条件`
* **函数**: `CUSTOM_ACTION`
* **位置**: `REPEATER`
```javascript
id: eb57d5bd-33e2-4a8c-bf51-bc81bd26613a
name: 探测竞态条件
function: CUSTOM_ACTION
location: REPEATER
source: |+
/**
* 重复发送该请求 10 次，以触发竞态条件或请求走私，HTTP/2 使用单包攻击，HTTP/1 使用最后字节同步
*
* @author James Kettle
**/
int NUMBER_OF_REQUESTS = 10;
var reqs = new ArrayList();
for (int i = 0; i < NUMBER_OF_REQUESTS; i++) {
reqs.add(requestResponse.request());
}
var responses = api().http().sendRequests(reqs);
var codes = responses.stream().map(HttpRequestResponse::response).map(HttpResponse::statusCode).toList();
logging().logToOutput(codes);
```
#### 2）从 Repeater 启动
1. 在 Repeater 中： **自定义操作** → 从示例中添加。
* 加载已创建的自定义操作。
测试使用 **30 个请求**.
我们看到 **状态码** （针对 30 次发送），我们可以更容易触发竞态条件
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/web/race-conditions/race-conditions-that-bypass-limits.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.