From 5cb2284819c78cbc2a01570ff8f11502f79c0463 Mon Sep 17 00:00:00 2001 From: Mehdi Date: Thu, 24 Aug 2023 11:36:51 +0330 Subject: [PATCH] Update Race Condition.md --- Race Condition.md | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/Race Condition.md b/Race Condition.md index 10156df..ad1044e 100644 --- a/Race Condition.md +++ b/Race Condition.md @@ -216,8 +216,12 @@ One such example is when high-resolution timestamps are used instead of cryptogr Consider a password reset token that is only randomized using a timestamp. In this case, it might be possible to trigger two password resets for two different users, which both use the same token. All you need to do is time the requests so that they generate the same timestamp. -![info] -To confirm for example the previous situation you could just ask for 2 reset password tokens at the same time (using single packet attack) and check if they are the same. + + +> ⚠️ NOTE +> +> To confirm for example the previous situation you could just ask for 2 reset password tokens at the same time (using single packet attack) and check if they are the same. + ## Hidden substates case studies ### Confirm other emails