skills.rest
AKasem1
AKasem1COMMUNITY
Explore all skills by this author →
WebsiteGitHub

hunt-race-condition

Detect race condition vulnerabilities in business-logic workflows via synchronized parallel requests.

Updated Aug 23, 2026
Search Tags:#race conditions#business logic#bug bounty#Burp Suite#concurrency testing#HTTP/2#double spend
One-click install
npx skills add https://github.com/AKasem1/claude-bug-bounty --skill hunt-race-condition
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-race-condition
Source: https://github.com/AKasem1/claude-bug-bounty/tree/main/skills/hunt-race-condition
Command: npx skills add https://github.com/AKasem1/claude-bug-bounty --skill hunt-race-condition

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps you find and validate race condition vulnerabilities where a server fails to make “check then act” operations atomic, allowing multiple concurrent requests to slip through.

Core Features & Use Cases

  • Targets business-logic races: focus on limited-use actions like votes, coupons, invites, credits, payments, transfers, and deletion windows.
  • Runs a parallel exploitation workflow: sets up synchronized multi-request attacks (e.g., HTTP/2 single-packet) to trigger double execution.
  • Validates real impact: confirms the duplicated effect via state changes (balance/credits, counts, coupon status, or access outcomes) and measures reproducibility.

Use case: you suspect a coupon redeem endpoint or credit deduction flow is vulnerable, so you run parallel requests to demonstrate the same redeem action succeeds more than once, then document the exact timing and success rate.

Quick Start

Use the hunt-race-condition skill to race a suspected one-time endpoint (such as /redeem, /vote, or /checkout) with synchronized parallel requests and produce a reproducible validation that demonstrates duplicate state changes.

Frequently Asked Questions about hunt-race-condition

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for race conditions in business logic workflows?▼

Validate race condition impact by confirming duplicated state changes, such as altered balances, credits, or counts, and measuring the reproducibility of the concurrent request timing to document exact success rates.

How do I exploit double spend vulnerabilities using HTTP/2?▼

To validate a race condition attack, verify real state impact by checking for duplicate success responses or constraint violations across concurrent requests, then document the exact timing and success rate for reproducibility evidence.

What types of web endpoints are vulnerable to concurrency testing?▼

Race condition testing applies to bug bounty scenarios involving limited-use business logic workflows like votes, coupons, credits, payments, transfers, referrals, and deletion windows across typical web and API attack surfaces.

How do I validate a race condition bug bounty finding?▼

Validating race condition findings requires confirming real state impact by verifying duplicate success or constraint violations, then measuring the reproducibility of the concurrent request timing to document exact success rates.

Related Skills

Explore More Software Engineering Skills→
EntroVyxEntroVyx
3

hunt-race-condition

Orchestrate concurrent HTTP/2 requests to detect race condition vulnerabilities.

Community
Advanced
ajtazerajtazer

triage-validation

Validate bug bounty findings through sequential gate checks and evidence requirements.

Community
Advanced
securityfortechsecurityfortech
6

business-logic-flaws

Detect and exploit business logic flaws in web application workflows.

Official
Advanced
sayseven7sayseven7
11

race-condition

Test web applications for race conditions and TOCTOU flaws with synchronized request bursts.

Community
Advanced