## 1) Setup
* Log in as `wiener`.
* **Buy and redeem** a cheap **gift card** to have small store credit for experiments.
* In **Proxy → HTTP history**, identify:
* `GET /cart` (read cart)
* `POST /cart` (mutate cart: add/remove/update)
* `POST /cart/checkout` (commit order)
> Keep CSRF tokens and cookies **fresh and consistent** across requests.
---
## 2) Prove server-side cart state & collision potential
* Send `GET /cart` **with** session cookie ⇒ shows your cart.
* Send `GET /cart` **without** session cookie ⇒ shows empty cart.
**Inference:** cart state is server-side, keyed to session/user ⇒ **race is possible**.
Prepare the cart:
* Ensure the cart contains **one gift card only** (no jacket).
---
## 3) Benchmark (single connection, sequential)
* Send both requests to **Repeater**, add to a **Tab Group** in this exact order:
1. `POST /cart` (add jacket `productId=1&quantity=1`)
2. `POST /cart/checkout`
* **Send group → In sequence (single connection).**
Expect **“insufficient funds”** (baseline rejection).
(Optional) Warmup check:
* Temporarily add `GET /` to the beginning of the group and send in sequence once to observe timing; then remove it. This confirms network/back-end behavior won’t block your race.
---
## 4) Exploit (parallel dispatch on one connection)
* Reset cart to **one gift card** (remove jacket if present).
* Keep the three tabs in this order.
1. `POST /cart` (add jacket)
2. `POST /cart/checkout`
3. `GET /`
* **Send group → In parallel.**
* Use **single packet attack**
![[CleanShot 2025-08-18 at
[email protected]]]
**Success signals**
* `POST /cart/checkout` returns **200** with confirmation text **or** **302** to an order confirmation page.
* Order details show **Lightweight L33t Leather Jacket** despite your initial low balance.
If you get **“insufficient funds”**:
* Remove jacket from cart; ensure only gift card remains.
* Repeat **Parallel** send a few times.
---
## 5) Verify & finish
* Open **Order history** / confirmation page.
* Confirm the jacket is included in the completed order.
* Lab solved.
---