> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/race-conditions/race-conditions-that-bypass-limits.md).
# 绕过限制的竞争条件
面向 PortSwigger Web Security Academy 实验室的绕过限制的竞争条件笔记，包括利用流程、载荷测试、Burp Suite 验证和修复背景。
### 限制超支竞争条件
购买流程包含一个 **竞争条件** 这使你能够获得一个 **意想不到的价格** 在付款时。
#### 目标
成功购买 **轻量级 L33t 皮夹克**.
#### 数据 / 前提条件
* 凭据： `wiener:peter`
* 折扣码（20%）： `PROMO20`
* 可用信用额度： **$50**
* 夹克价格： **$1300**
### 行为观察
1. 将夹克加入购物篮。
2. 应用 `PROMO20` 优惠券。
3. 如果你尝试第二次应用优惠券，应用会返回： **优惠券已应用**.
优惠券应用请求如下（表单 URL 编码）：
```bash
csrf=7QYFGBaACc8P5YOfUHR4S85oo95uA0Vb&coupon=PROMO20
```
### 手动利用（Burp Repeater）
1. 将应用请求发送到 **Repeater**.
2. 创建一个 **组的成员** 在 Repeater 中。
* 将请求标签页复制约 20 次（**复制标签页**).
发送请求 **并行地**.
结果是大多数请求都被 **验证**，总额变为 **/\~37**，这使你能够在原价（$1300）和有限信用额度下仍然完成购买。
### 自动化利用（Burp Suite Pro 自定义操作）
该实验建议使用 **触发竞争条件** （Burp Suite Professional），通过一个 **自定义操作**.
#### 1）添加脚本（Bambda Library）
前往 **Extensions → Bambda 库** 并添加：
* **id**: `eb57d5bd-33e2-4a8c-bf51-bc81bd26613a`
* **name**: `探测竞争条件`
* **函数**: `CUSTOM_ACTION`
* **位置**: `REPEATER`
```javascript
id: eb57d5bd-33e2-4a8c-bf51-bc81bd26613a
name: 探测竞争条件
function: CUSTOM_ACTION
location: REPEATER
source: |+
/**
* 将请求重复 10 次以触发竞争条件或请求走私，在 HTTP/2 中使用单包攻击，在 HTTP/1 中使用最后字节同步
*
* @author James Kettle
**/
int NUMBER_OF_REQUESTS = 10;
var reqs = new ArrayList();
for (int i = 0; i < NUMBER_OF_REQUESTS; i++) {
reqs.add(requestResponse.request());
}
var responses = api().http().sendRequests(reqs);
var codes = responses.stream().map(HttpRequestResponse::response).map(HttpResponse::statusCode).toList();
logging().logToOutput(codes);
```
#### 2）从 Repeater 启动
1. 在 Repeater 中： **自定义操作** → 从样本中添加。
* 加载已创建的自定义操作。
使用以下内容测试 **30 个请求**.
我们看到 **状态码** （针对 30 个发送）并且我们可以更容易触发竞争条件
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/web/race-conditions/race-conditions-that-bypass-limits.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
