Skip to content
attack.paths
Sign in
← RegistryDossier · 5 steps · 4 edges

Single-packet race → coupon stacking

Coupon redemption check happens before the apply step. Send 20 redemptions in a single TCP packet — the app validates each in parallel and applies all of them.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: e-commerce / SaaS billing endpoint that validates a coupon then applies it without a serialised transaction. HTTP/2 connection support.

§ Steps

  1. 01
    Complete the order at near-zero costExfiltration
    T1041— Exfiltration Over C2 Channel
  2. 02
    Find coupon / quota endpointReconnaissance
    W-RECON-API-DISCO— API Endpoint Discovery
  3. 03
    Bundle 20 redemptions in single packet (H2)Impact
    W-RACE-SP— Single-Packet Race Condition

    Turbo Intruder gate / send-group.

  4. 04
    Apply N coupons against the cap of 1Impact
    W-BUSINESS-LOGIC— Business Logic Flaw
  5. 05
    Reproduce check-then-apply windowImpact
    W-BUSINESS-LOGIC— Business Logic Flaw

§ References

§ Frequently asked

What is the "Single-packet race → coupon stacking" attack path?
Coupon redemption check happens before the apply step. Send 20 redemptions in a single TCP packet — the app validates each in parallel and applies all of them. It chains 5 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Complete the order at near-zero cost (T1041) — a exfiltration primitive. Assumed environment: e-commerce / SaaS billing endpoint that validates a coupon then applies it without a serialised transaction.
What is the final impact of this kill-chain?
The final step lands on Reproduce check-then-apply window (W-BUSINESS-LOGIC), which falls under Impact. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers