Testing for Race Conditions (OWASP-AT-010) - Revision history

KirstenS: /* Black Box testing and example */

2009-02-05T13:13:55Z

‎Black Box testing and example

2008-12-13T20:05:23Z

‎Black Box testing and example

2008-12-13T20:04:28Z

‎Description of the Issue

2008-12-13T20:03:30Z

‎Brief Summary

2008-12-07T15:16:17Z

2008-09-07T17:20:25Z

‎Gray Box testing and example

2008-08-24T23:20:35Z

‎Black Box testing and example

2008-08-24T23:10:45Z

‎References

2008-08-24T23:10:35Z

‎References

2008-08-24T23:06:36Z

‎Black Box testing and example

@@ Line 33: / Line 33: @@
 ==Black Box testing and example==
-Testing for race conditions is problematic due to their nature, and external influences on testing including server load, network latency etc will all play a part in the presence and detection of the condition.<br>
+Testing for race conditions is problematic due to their nature, and external influences on testing including server load, network latency, etc. will all play a part in the presence and detection of the condition.
 However, testing can be focused on specific transactional areas of the application, where time-of-read to time-of-use of specific data variables could be adversely affected by concurrency issues.
-<br>
 Black Box testing attempts to force a race condition may include the ability to make multiple simultaneous requests while observing the outcome for unexpected behavior.
-<br>
 Examples of such areas are illustrated in the paper "On Race Vulnerabilities in Web Applications", cited in the further reading section. The authors suggest that it may be possible in certain circumstances to:
 * Create multiple user accounts with the same username.
 * Bypass account lockouts against brute forcing.
-<br>
 Testers should be aware of the security implications of race conditions and their factors surrounding their difficulty of testing.

@@ Line 34: / Line 34: @@
 ==Black Box testing and example==
 Testing for race conditions is problematic due to their nature, and external influences on testing including server load, network latency etc will all play a part in the presence and detection of the condition.<br>
-However, testing can be focused at specific transactional areas of the application, where time of read to time of use of specific data variables could be adversely affected by concurrency issues.
+However, testing can be focused on specific transactional areas of the application, where time-of-read to time-of-use of specific data variables could be adversely affected by concurrency issues.
 <br>
 Black Box testing attempts to force a race condition may include the ability to make multiple simultaneous requests while observing the outcome for unexpected behavior.

@@ Line 7: / Line 7: @@
 Race conditions may occur when a process is critically or unexpectedly dependent on the sequence or timings of other events.
 In a web application environment, where multiple requests can be processed at a given time, developers may leave concurrency to be handled
-by the framework, server or programming language.
+by the framework, server, or programming language.
 The following simplified example illustrates a potential concurrency problem in a transactional web application and relates to a joint savings account in which both users (threads) are logged into the same account and attempting a transfer.<br>
 <br>
@@ Line 30: / Line 30: @@
 <br>
-Another example can be seen in OWASP's WebGoat project under the Thread Safety lesson and shows how a shopping cart can be manipulated to purchase items for less than their advertised price. This, as with the example above, is due to the data changing between the time of check and its time of use.
+Another example can be seen in OWASP's WebGoat project in the Thread Safety lesson, and shows how a shopping cart can be manipulated to purchase items for less than their advertised price. This, as with the example above, is due to the data changing between the time of check and its time of use.
 ==Black Box testing and example==

@@ Line 2: / Line 2: @@
 == Brief Summary ==
-A race condition is a flaw that produces an unexpected result when timing of actions impact other actions. An example may be seen on a multithreaded application where actions are being performed on the same data. Race conditions, by their very nature, are difficult to test for.
+A race condition is a flaw that produces an unexpected result when the timing of actions impact other actions. An example may be seen on a multithreaded application where actions are being performed on the same data. Race conditions, by their very nature, are difficult to test for.
 ==Description of the Issue==

@@ Line 47: / Line 47: @@
 ==Gray Box testing and example==
-Code review may reveal likely areas of concern for concurrency issues. More information on reviewing code for concurrency issues can be seen at:<br>
+Code review may reveal likely areas of concern for concurrency issues. More information on reviewing code for concurrency issues can be seen at OWASP Code Review Guide's [[Reviewing Code for Race Conditions]]
 ==References==

← Older revision	Revision as of 15:16, 7 December 2008
(No difference)

@@ Line 47: / Line 47: @@
 iSec Partners - Concurrency attacks in Web Applications http://isecpartners.com/files/iSEC%20Partners%20-%20Concurrency%20Attacks%20in%20Web%20Applications.pdf<br>
 B. Sullivan and B. Hoffman - Premature Ajax-ulation and You https://www.blackhat.com/presentations/bh-usa-07/Sullivan_and_Hoffman/Whitepaper/bh-usa-07-sullivan_and_hoffman-WP.pdf<br>
-Thread Safety Challenge in WebGoat - http://www.owasp.org/index.php/OWASP_WebGoat_Project
+Thread Safety Challenge in WebGoat - http://www.owasp.org/index.php/OWASP_WebGoat_Project<br>
 R. Paleari, D. Marrone, D. Bruschi, M. Monga - On Race Vulnerabilities in Web Applications http://security.dico.unimi.it/~roberto/pubs/dimva08-web.pdf

← Older revision		Revision as of 23:10, 24 August 2008
Line 48:		Line 48:
	B. Sullivan and B. Hoffman - Premature Ajax-ulation and You https://www.blackhat.com/presentations/bh-usa-07/Sullivan_and_Hoffman/Whitepaper/bh-usa-07-sullivan_and_hoffman-WP.pdf<br>		B. Sullivan and B. Hoffman - Premature Ajax-ulation and You https://www.blackhat.com/presentations/bh-usa-07/Sullivan_and_Hoffman/Whitepaper/bh-usa-07-sullivan_and_hoffman-WP.pdf<br>
	Thread Safety Challenge in WebGoat - http://www.owasp.org/index.php/OWASP_WebGoat_Project		Thread Safety Challenge in WebGoat - http://www.owasp.org/index.php/OWASP_WebGoat_Project
		+	R. Paleari, D. Marrone, D. Bruschi, M. Monga - On Race Vulnerabilities in Web Applications http://security.dico.unimi.it/~roberto/pubs/dimva08-web.pdf