myvector

Hey man, what’s up?

Remember I ended the last post with “my first duplicate ❤️”? You thought the heart emoji was a joke, right? Yes and no. This post explains that heart.

In my hacking journey — 6 months in right now, know your place everybody 🤣 — the fairest triager I met was the guy who hit me with a duplicate in 2 hours. But don’t get “fair” wrong. It’s not just praise. This ecosystem is so messed up that basic honesty feels like hero stuff. The guy just did his job. He didn’t bullshit me. He just read the report, saw the bug, and said “this was reported before, thanks.” And in this ecosystem, that’s a five-star performance. That’s the reality.

In the last post, I couldn’t convince the triager how bad a wrongly-stored variable could get. So, I got mad and kept attacking the same program. Back then, I didn’t have a test to see if a program was worth my time without playing with it first. I just had a basic rule for myself: stay for a month no matter what, and hit whatever you find. Later I saw it doesn’t work like that. The test came later. We’ll talk about that shit another time. How I pick programs and how I get slapped with informatives 101 🤣

Anyway, today’s topic. But first, let’s show some respect to the bro who first thought of race conditions — RIP if he’s gone, love to him if he’s still around. The reason I love hacking is exactly this kind of shit. The trickery is the game. The technical stuff is just noise. I mean, how does a database even handle two requests sent at the exact same time? I still love this idea 😂. And system architects can’t think like this, man. This takes a different mindset. Architects look for the happy path. They don’t expect some random guy to push the same coupon four times in a row, and well, they didn’t.

But one important note: Technique < Mindset. Yeah, you can solve a race condition in Uncle Kettle’s labs. But trying it on a real system is trying to break an assumption. Catching that surface is the whole game.

I spotted that surface right in their own rules. The promo codes were strictly unstackable and tagged with: ‘Valid off your first booking only.’ But that got me thinking… could a ‘first-time’ loop just run forever? I mean, isn’t every booking technically a ‘first’ booking? You can’t step into the same river twice anyway, right bro? Hahaha.

The Anatomy of a Race Condition

Anyway, time to deploy my highly sophisticated master plan. While I was messing around with this coupon shit, by the power vested in me by the test environment, I poked around. What did I enter? The first letter of the alphabet. Heheh. Aleph. Elif. A. Alpha. Whatever. I entered ‘A’ and boom — a 20-pound code. Wait, where the fuck did this come from? Okay, if A exists, does B exist too? But it only let me add one at a time. What now? My absolute genius move was to spin up countless dummy accounts for every single code just to test them out.

Told you I’m smart amk 😂. In the end, I had my accounts and A, B, C. Three coupons, 20 pounds each. I thought, can I report this? No way. What am I gonna tell them — “Who makes ‘A’ a coupon code, change this”? Pass. No money here. I moved to other surfaces.

Like I said at the start, there’s a lightbulb moment. That race condition intro wasn’t for nothing, right? Keh keh keh, everything is a setup, matrix, yoo! I said before: everything starts with a question. One of those questions dropped into my head:

If I send all these coupons at the exact same time, how does the DB react?

Great question, but what’s the answer? I read some shit about “race” but how do you actually pull it off? No clue, moruk. I ran straight to Gemini. “Yo dude, there’s this thing, how does it work?” And bless him, he walked me through it step by step. I also watched a YouTube video, uff. I’m a parallel sending master now 😂. I learn everything from YouTube, by the way. I even learned how to swim from there. No joke. Anyway, moving on, the technical part was done.

Next stage. I thought, I have 3 working promo codes. But why only send 3? Let me look around — there are tons of sites giving out coupons. Out of every 3 coupons they give, 4 are wrong, but whatever. After about two days of ad redirects and shady ads labyrinths, I had 2 more coupons to test :))

Executing the Race Condition in Burp Suite

Redeem buttons ready. Burp intercept on (damn you, Caido, still making us rely on Burp for this shit 🤣) and boom, packet caught mid-air. Ctrl + R, exactly five times. Five packets in Repeater, ready to go. Codes are loaded: A, B, C, and the two I worked so hard for. Right click, create group. Name it “race.” Don’t hit Send directly — click the little arrow next to it, and fire the “parallel send” option. Those moments, man… I can still taste it. Bro, you’d get this if you mess with this stuff, which is why you’ve read this far, respect man. Then those 2 seconds where you wait for the responses. Bro, those 2 seconds are some zen shit, I’m telling you.

Then I look… 200, 200, 200… Wait, one more 200. Four codes went in, hahaha. Check the SS below.

For a second I thought, holy shit, did this really happen? It did, moruk. But you couldn’t stop me there. I had to go deeper and raise the stakes. Were these really attached to the user? Would the booking accept them? Would the price drop? A bunch of questions, and yes man, all tests came back positive.

I had a juicy bug, hahah. Ran to Gemini, told the story, wrote a killer report.

And 2 hours later, the triager said: thank you brother, beautiful duplicate ❤️.

Now, what did I say in the last post? Be fair, break my arm, I won’t make a sound. But catch the irony here. I’m calling this guy a ‘hero’ just for doing the bare fucking minimum. That’s how low the bar is in this ecosystem — it’s literally in hell. You’ll see when I tell the next stories. You hand other triagers a huge bug and they hit you with ‘nah, our fraud system catches that,’ ‘where’s the order code,’ ‘what about this, what about that.’ Just read the fucking report, man. This guy didn’t do any of that bullshit. He just clicked the ‘duplicate’ button without making me want to smash my keyboard. And boom, suddenly he looks like a legend. That’s the real joke here.

Now let’s be real, hacı. I ate this duplicate because someone actually found it first. The report was solid, screenshots were there, backend evidence was there. It wouldn’t even drop to need-info. I was just late. Bug bounty is a speed game — no matter how deep you look, if you’re not at the door when it opens, you lose. My “assumption breaking” style likes deep looking. Speed fights with that. That’s the truth of the system.

That’s why the duplicate didn’t actually piss me off. I felt validated. My finding was real, someone else saw it too, I was just unlucky. Late, but not wrong. That counts as a win in my book.

Next post: how I push this race shit to the max on those famous game-selling guys’ site, and how their system pulled a race condition on my actual bank account, leaving me with a joke of a payout 🤣

Verdict: Better finder, better luck. Au revoir.