Nullcon Goa 2023 | Smashing The State Machine: The True Potential Of Web Race Conditions by James

This talk explores the largely unexplored potential of web race-condition attacks, revealing multiple new classes that extend beyond familiar limit-overrun exploits. The speaker discusses the underlying state machines in websites and demonstrates how conflicting inputs can cause state machines to collapse, leading to the creation of trusted data and the misrouting of tokens. The session presents a polished methodology for effectively testing these vulnerabilities and a strategy to adapt attacks for different HTTP versions, utilizing precision tooling developed from years of research on HTTP Desync Attacks. Attendees will gain insights into recognizing high-risk patterns and will have access to open source tools and free online labs through the Web Security Academy to practice their new skills.