Limit Overrun Race Conditions in Web App Penetration Testing | 2023
The most well-known type of race condition enables you to exceed some kind of limit imposed by the business logic of the application | Karthikeyan Nagaraj
6 min readSep 24, 2023
Limit overrun race conditions
The most well-known type of race condition enables you to exceed some kind of limit imposed by the business logic of the application.
For example, consider an online store that lets you enter a promotional code during checkout to get a one-time discount on your order. To apply this discount, the application may perform the following high-level steps:
- Check that you haven’t already used this code.
- Apply the discount to the order total.
- Update the record in the database to reflect the fact that you’ve now used this code.
If you later attempt to reuse this code, the initial checks performed at the start of the process should prevent you from doing this:
