I'm making a small CTF for my digital team to teach them about different exploits. I'm hoping to include a race condition example but everything I've found manipulates a local file or SQL database (so multiple users can't follow along at the same time).

Does anybody have a sample race condition I can use in a CTF with multiple people at once? Unfortunately because of our internal process I can't use online sources for this and need to host something local.

  • I am not sure I understand the question. What sort of race condition are you looking for? – Limit Apr 11 '17 at 16:40
  • @Limit As per the tags a web application that has an intentional race condition flaw. The language doesn't matter since it's not the point of the exercise. – Michael A Apr 11 '17 at 22:40

Back in 2011, Taylor Hornby wrote a TOCTTOU vulnerable PHP web application that is often found in banks and such that can cause Race Condition bugs, its a cool application.

The application is well explained in https://defuse.ca/race-conditions-in-web-applications.htm and I think can become a useful resource. (it explains a lot of issues and responses to each)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.