Part 3 Lab
Video Activity
In this lab-based lesson, participants use Web Goat to exploit the concurrency error in the application and view the login information for another user that is attempting the same function. This requires the use of two browsers and shows issues with thread safety and the resulting problems.
Join over 3 million cybersecurity professionals advancing their career
Sign up with
Required fields are marked with an *
or
Already have an account? Sign In »
Video Description
In this lab-based lesson, participants use Web Goat to exploit the concurrency error in the application and view the login information for another user that is attempting the same function. This requires the use of two browsers and shows issues with thread safety and the resulting problems.
Video Transcription
00:04
hello and welcome to secure coding. Course my name Miss anywhere,
00:08
and we will be looking at the lab for the honorable mention section.
00:14
Now for this particular lab, you're going to bring up Web goat, and you need to go ahead and go toothy concurrency menu
00:24
and click the thread safety problems.
00:27
Now, in order to perform this lab, it says the user should be able to exploit the concurrency error in this weather application and view log in information for another user does that is attempting the same function at the same time. This will require the use of two browsers.
00:47
The valid user names are Jeff and Dave.
00:50
Now, in order to perform this lab, all you need to do is actually just create another tab open at the same menu location.
01:00
Now, in one of the boxes, you're going to type Jeff,
01:04
and in your other tab, you're going to type in the box. Dave.
01:11
Now, remember that from our previous discussion, this is about thread safety, and so two threads are going to try to access the same information at the same time, and we're going to see the problem that occurs because of that
01:27
So let's go ahead and try to click submit at the exact same time.
01:40
Okay, And so what you can see is that I'm now seeing Dave's information
01:47
on both displays rate. And so
01:52
the way to make this lab work if you're having trouble is
01:57
you've you've got to be able to click both submits while the browser is still spinning, and so then you'll be able to actually solve the lab.
02:09
So from a secure coding perspective, if you actually click this show job a button,
02:16
you can see the code that was written on the back end. And
02:22
if you just scroll through some of the code, look for a variable called current user and you'll see here that we've got a method called create context. We're passing in a Web session.
02:38
We create a database connection.
02:43
We parse are our parameter user name, and we make that our current user.
02:51
And then, of course, we assign it to use your one,
02:54
and we basically do this this query where we pass in that that current user value
03:05
now the problem, as we spoke of in
03:07
in our explanation off of race conditions, is that we don't have any way of protecting the threads from each other. And so any thread can come in here and run this query
03:27
and and they're not mutually exclusive. And so we would really need to have this code segregated so that each thread can perform the particular query or in a thread safe method.
03:43
Ah, in order for each thread to perform the query
03:46
a mutually exclusive from each other.
Up Next
Instructed By
Similar Content
