Vulnerable Web App

There are three challenges, all of them vulnerable to race conditions. You can try to exploit the race condition weaknesses with tools such as Raceocat.

RACE_WINDOW is 50 ms.
For this testing environment a artifically race window might be required because this application is created with a small sample data set. By increasing the RACE_WINDOW value you can simulate a slow webserver or a unperformant database and increase your chances. You can change or disable it by adding ?race_window=0 (in microseconds) as parameter.

Challenge 1: Bank account withdraw

You can withdraw only enough money so that your bank account is not in the negative. Your bank account can not overspend.

View bank account balance of accountID 1
View bank account balance of accountID 2
Action: Withdraw 500€ from accountID 1

Challenge 2: Multiple poll votes

You are only allowed to like a postingID once. Similar to a facebook post or a twitter feed.

View all the likes of postingID 1
Action: Like postingID 1 with userID 5

Already liked, can't like twice.
The posting with postingID 1 was liked by the following people:
- Liked by userID 2
- Liked by userID 1
- Liked by userID 5
- Liked by userID 4
- Liked by userID 4
- Liked by userID 4
- Liked by userID 4
- Liked by userID 3
- Liked by userID 3
- Liked by userID 3
- Liked by userID 3
- Liked by userID 6
- Liked by userID 6
- Liked by userID 6
- Liked by userID 6
- Liked by userID 7
- Liked by userID 7
- Liked by userID 7
- Liked by userID 7
- Liked by userID 7
- Liked by userID 8
- Liked by userID 9
- Liked by userID 9
- Liked by userID 9
- Liked by userID 9
- Liked by userID 9
- Liked by userID 10
- Liked by userID 0
- Liked by userID 0
- Liked by userID 0
- Liked by userID 0
- Liked by userID 0
- Liked by userID 99
- Liked by userID 99
- Liked by userID 99
- Liked by userID 99
- Liked by userID 99
- Liked by userID 555
- Liked by userID 555
- Liked by userID 555
- Liked by userID 555
- Liked by userID 555
- Liked by userID 77
- Liked by userID 777
- Liked by userID 777
- Liked by userID 777
- Liked by userID 777
- Liked by userID 777
- Liked by userID 7777
- Liked by userID 7777
- Liked by userID 7777
- Liked by userID 7777
- Liked by userID 7777
- Liked by userID 11
- Liked by userID 11
- Liked by userID 11
- Liked by userID 11
- Liked by userID 11
- Liked by userID 12
- Liked by userID 12
- Liked by userID 12
- Liked by userID 12
- Liked by userID 13
- Liked by userID 13
- Liked by userID 13
- Liked by userID 13
- Liked by userID 13
- Liked by userID 14
- Liked by userID 15
- Liked by userID 15
- Liked by userID 16
- Liked by userID 16
- Liked by userID 16
- Liked by userID 17
- Liked by userID 17
- Liked by userID 17
- Liked by userID 17
- Liked by userID 25
- Liked by userID 25
- Liked by userID 25
- Liked by userID 24
- Liked by userID 23
- Liked by userID 18
- Liked by userID 18
- Liked by userID 18
- Liked by userID 18
- Liked by userID 18
- Liked by userID 55
- Liked by userID 55
- Liked by userID 55
- Liked by userID 55
- Liked by userID 55
- Liked by userID 324
- Liked by userID 111
- Liked by userID 111
- Liked by userID 111
- Liked by userID 111
- Liked by userID 111
- Liked by userID 1337
- Liked by userID 1338
- Liked by userID 1338
- Liked by userID 1338
- Liked by userID 1338
- Liked by userID 1338
- Liked by userID 1339
- Liked by userID 1339
- Liked by userID 1339
- Liked by userID 1339
- Liked by userID 1339
- Liked by userID 2000
- Liked by userID 4404
- Liked by userID 2760
- Liked by userID -6305
- Liked by userID -8345
- Liked by userID -2329
- Liked by userID -7924
- Liked by userID -9615
- Liked by userID -3353
- Liked by userID -5043
- Liked by userID -7017
- Liked by userID -8145
- Liked by userID -7080
- Liked by userID -8288
- Liked by userID -1860
- Liked by userID -8095
- Liked by userID -2867
- Liked by userID -8063
- Liked by userID -9417
- Liked by userID -5277
- Liked by userID -5931
- Liked by userID -9910
- Liked by userID -2644
- Liked by userID -2296
- Liked by userID -8702
- Liked by userID -2842
- Liked by userID -5533
- Liked by userID -3899
- Liked by userID -7553
- Liked by userID -6821
- Liked by userID -9741
- Liked by userID -7013
- Liked by userID -3633
- Liked by userID -2569
- Liked by userID -1793
- Liked by userID -8502
- Liked by userID -7453
- Liked by userID -9367
- Liked by userID -9408
- Liked by userID -5944
- Liked by userID -6012
- Liked by userID -5422
- Liked by userID -7850
- Liked by userID -7223
- Liked by userID -2982
- Liked by userID -7127
- Liked by userID -5142
- Liked by userID -2540
- Liked by userID -2362
- Liked by userID -5057
- Liked by userID -1905
- Liked by userID -8058
- Liked by userID -6211
- Liked by userID -5590
- Liked by userID -6029
- Liked by userID -7001
- Liked by userID -6348
- Liked by userID -6397
- Liked by userID -2306
- Liked by userID -5457
- Liked by userID -3383
- Liked by userID -1578
- Liked by userID -4228
- Liked by userID -9278
- Liked by userID -1011
- Liked by userID -2346
- Liked by userID -4070
- Liked by userID -8366
- Liked by userID -5612
- Liked by userID -4271
- Liked by userID -8231
- Liked by userID -5801
- Liked by userID -1110
- Liked by userID -1218
- Liked by userID -2326
- Liked by userID -3027
- Liked by userID -2800
- Liked by userID -8888
- Liked by userID -3959
- Liked by userID -6246
- Liked by userID -2370
- Liked by userID -4966
- Liked by userID -9869
- Liked by userID -4717
- Liked by userID -7858
- Liked by userID -4452
- Liked by userID -3073
- Liked by userID -7786
- Liked by userID -3934
- Liked by userID -5237
- Liked by userID -2452
- Liked by userID -7805
- Liked by userID -3839
- Liked by userID -6676
- Liked by userID -1201
- Liked by userID -5318
- Liked by userID -6286
- Liked by userID -1809
- Liked by userID -2228
- Liked by userID -4177
- Liked by userID -5103
- Liked by userID -6971
- Liked by userID -6958
- Liked by userID -6242
- Liked by userID -1069
- Liked by userID -5707
- Liked by userID -4069
- Liked by userID -5198
- Liked by userID -7983
- Liked by userID -6944
- Liked by userID -9258
- Liked by userID -1206
- Liked by userID -1182
- Liked by userID -2724
- Liked by userID -6523
- Liked by userID -2281
- Liked by userID -5980
- Liked by userID -5488
- Liked by userID -5491
- Liked by userID -2258
- Liked by userID -7250
- Liked by userID -2441
- Liked by userID -8442
- Liked by userID -5074
- Liked by userID -1682
- Liked by userID -5373
- Liked by userID -9679
- Liked by userID -4892
- Liked by userID -3774
- Liked by userID -6866
- Liked by userID -3629
- Liked by userID -8354
- Liked by userID -6801
- Liked by userID -2754
- Liked by userID 5123
- Liked by userID 1999
- Liked by userID 1999
- Liked by userID 1999
- Liked by userID 1999
- Liked by userID 1999
- Liked by userID 12332
- Liked by userID 12312311
- Liked by userID 222222
- Liked by userID 222221
- Liked by userID 12312322
- Liked by userID 1231232211
- Liked by userID 1231232211
- Liked by userID 1231232211
- Liked by userID 1997
- Liked by userID 1998
- Liked by userID 1998
- Liked by userID 1998
- Liked by userID 1998
- Liked by userID 1998
- Liked by userID 19999
- Liked by userID 19999
- Liked by userID 19999
- Liked by userID 19999
- Liked by userID 19999
- Liked by userID 121212
- Liked by userID 121213
- Liked by userID 121213
- Liked by userID 121214
- Liked by userID 121214
- Liked by userID 121214
- Liked by userID 121214
- Liked by userID 121214
- Liked by userID 121215
- Liked by userID 121215
- Liked by userID 121215
- Liked by userID 121215
- Liked by userID 121215
- Liked by userID 121216
- Liked by userID 121216
- Liked by userID 121216
- Liked by userID 121216
- Liked by userID 121216
- Liked by userID 121217
- Liked by userID 121217
- Liked by userID 121217
- Liked by userID 121217
- Liked by userID 121217
- Liked by userID 121218
- Liked by userID 121218
- Liked by userID 121218
- Liked by userID 121218
- Liked by userID 121218
- Liked by userID 5432
- Liked by userID 5444
- Liked by userID 5445
- Liked by userID 5446
- Liked by userID 5446
- Liked by userID 5446
- Liked by userID 5447
- Liked by userID 5448
- Liked by userID 5449
- Liked by userID 19971
- Liked by userID 5454
- Liked by userID 19972
- Liked by userID 19975
- Liked by userID 19976
- Liked by userID 99991111
- Liked by userID 99991111
- Liked by userID 99991111
- Liked by userID 99991111
- Liked by userID 99991111
- Liked by userID 99991113
- Liked by userID 99991113
- Liked by userID 99991113
- Liked by userID 99991113
- Liked by userID 99991113
- Liked by userID 12322
- Liked by userID 12322
- Liked by userID 12322
- Liked by userID 99991112
- Liked by userID 999911144
- Liked by userID 12322123
- Liked by userID 12322123
- Liked by userID 12322123
- Liked by userID 1232333
- Liked by userID 999911143
- Liked by userID 999911122
- Liked by userID 999911122
- Liked by userID 999911122
- Liked by userID 999911122
- Liked by userID 999911122
- Liked by userID 1997223125
- Liked by userID 199744445
- Liked by userID 199333
- Liked by userID 1991234
- Liked by userID 99944442
- Liked by userID 145
- Liked by userID 147
- Liked by userID 147
- Liked by userID 147
- Liked by userID 147
- Liked by userID 263
- Liked by userID 267
- Liked by userID 222
- Liked by userID 222
- Liked by userID 222
- Liked by userID 222
- Liked by userID 222
- Liked by userID 115
- Liked by userID 169
- Liked by userID 224
- Liked by userID 2242
- Liked by userID 11111
- Liked by userID 22422
- Liked by userID 231
- Liked by userID 2311
- Liked by userID 23111
- Liked by userID 34
- Liked by userID 34
- Liked by userID 34
- Liked by userID 34
- Liked by userID 35
- Liked by userID 342
- Liked by userID 342
- Liked by userID 342
- Liked by userID 342
- Liked by userID 3421
- Liked by userID 300
- Liked by userID 301
- Liked by userID 999
- Liked by userID 9999
- Liked by userID 29
- Liked by userID 79
- Liked by userID 89
- Liked by userID 80
- Liked by userID 80
- Liked by userID 80
- Liked by userID 80
- Liked by userID 80
- Liked by userID 81
- Liked by userID 888
- Liked by userID 888
- Liked by userID 888
- Liked by userID 888
- Liked by userID 91
- Liked by userID 889
- Liked by userID 889
- Liked by userID 889
- Liked by userID 889
- Liked by userID 14501
- Liked by userID 56
- Liked by userID 57
- Liked by userID 2147483647
- Liked by userID 99999
- Liked by userID 5532
- Liked by userID 237
- Liked by userID 237
- Liked by userID 237
- Liked by userID 2016
- Liked by userID 1000
- Liked by userID 2010
- Liked by userID 201
- Liked by userID 2008
- Liked by userID 2008
- Liked by userID 2980
- Liked by userID 2078
- Liked by userID 8585
- Liked by userID 8585
Total likes: 412

Challenge 3: Brute force 2FA code

To slow down brute forcing attacks you are only allowed to login 5 times per 5 minutes.

View login log for [email protected]
Action: Try to login using 0022 as 2FA code
Action: Try to login using 0012 as 2FA code

Debug info

PHP version: 8.3.28
MySql version: 10.6.22-MariaDB-0ubuntu0.22.04.1

Executed SQL queries:
#1 - 0.3 ms - "SELECT postingID, userID FROM likes WHERE userID = 5 AND postingID = 1"
#2 - 0.2 ms - "SELECT postingID, userID FROM likes WHERE postingID = 1"

Processed in: 3.2 ms