Lesson Plan Title: Shopping Cart Concurrency Flaw

Concept / Topic To Teach:
Web applications can handle many HTTP requests simultaneously. Developers often use variables that are not thread safe.  Thread safety means that the fields of an object or class always maintain a valid state when used concurrently by multiple threads. It is often possible to exploit a concurrency bug by loading the same page as another user at the exact same time. Because all threads share the same method area, and the method area is where all class variables are stored, multiple threads can attempt to use the same class variables concurrently.

General Goal(s):
For this exercise, your mission is to exploit the concurrency issue which will allow you to purchase merchandise for a lower price.

Solution:

1. Open a new browser window on the same page.

2. In window A you choose a low cost item and click "Purchase".


Window A


3. In window B you choose the a high cost item you want to buy and click "update cart". The variable of the price has been overwritten now.


Window B


4. In window A you can click click "Confirm" and you bought your item for a lower price.


Window A Success