> For the complete documentation index, see [llms.txt](https://notes.dollarboysushil.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.dollarboysushil.com/web-application-pentest/bugforge/race-condition/shady-oaks-financial.md).

# Shady Oaks Financial

Level: Easy\
Points: 10\
Type: Daily Challenge

After Sign-up , login the interesting feature is ability to exchange currency.\
At the beginning, we have €1000

First thing that comes in my mind looking at the conversion feature is possibility of Race Condition.\
For this, I tried to convert all €1000 to USD.

<figure><img src="/files/8rXmIesthrMxnFxQWNOF" alt=""><figcaption></figcaption></figure>

Intercept request,

<figure><img src="/files/swcTDEINYIbjhAWbNaFa" alt=""><figcaption></figcaption></figure>

Send request to repeater, Drop request from Intercept tab

In repeater tab, create multiple duplicate tab, add all them to group and select send group (parallel)

<figure><img src="/files/jKnN7Pf0Qw6UOBj8l2zr" alt=""><figcaption></figcaption></figure>

Send request as group (parallel), triggers Race conditions and gives us flag.