5d930ec235
* Solutions added * Bugfixes * Introduction added (including how to start with webgoat and useful tools) * New lesson: Password strength * New lessons: Multi Level Login * Not yet working new lesson: Session fixation (inital release) git-svn-id: http://webgoat.googlecode.com/svn/trunk/webgoat@301 4033779f-a91e-0410-96ef-6bf7bf53c507
32 lines
2.0 KiB
HTML
32 lines
2.0 KiB
HTML
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
|
<html>
|
|
<head>
|
|
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
|
|
<title>Shopping Cart Concurrency Flaw</title>
|
|
<link rel="stylesheet" type="text/css" href="/WebGoat/lesson_solutions/formate.css">
|
|
</head>
|
|
<body>
|
|
<p><b>Lesson Plan Title:</b> Shopping Cart Concurrency Flaw</p>
|
|
|
|
<p><b>Concept / Topic To Teach:</b><br/>
|
|
Web applications can handle many HTTP requests simultaneously. Developers often use variables that are not thread safe. Thread safety means that the fields of an object or class always maintain a valid state when used concurrently by multiple threads. It is often possible to exploit a concurrency bug by loading the same page as another user at the exact same time. Because all threads share the same method area, and the method area is where all class variables are stored, multiple threads can attempt to use the same class variables concurrently. <br>
|
|
</p>
|
|
|
|
<p><b>General Goal(s):</b><br/>
|
|
For this exercise, your mission is to exploit the concurrency issue which will allow you to purchase merchandise for a lower price.
|
|
</p>
|
|
|
|
<b>Solution:</b><br/><br/>
|
|
1. Open a new browser window on the same page.<br/><br/>
|
|
2. In window A you choose a low cost item and click "Purchase".<br/><br/>
|
|
<img src="/WebGoat/lesson_solutions/ConcurrencyCart_files/image001.jpg"><br/>
|
|
<font size="2"><b>Window A</b></font><br/><br/><br/>
|
|
3. In window B you choose the a high cost item you want to buy and click "update cart". The variable of the price has been overwritten now.<br/><br/>
|
|
<img src="/WebGoat/lesson_solutions/ConcurrencyCart_files/image002.jpg"><br/>
|
|
<font size="2"><b>Window B</b></font><br/><br/><br/>
|
|
4. In window A you can click click "Confirm" and you bought your item for a lower price.<br/><br/>
|
|
<img src="/WebGoat/lesson_solutions/ConcurrencyCart_files/image003.jpg"><br/>
|
|
<font size="2"><b>Window A Success</b></font><br/>
|
|
<br><br><br>
|
|
</body>
|
|
</html> |