hunt-race-condition

Identify race-condition vulnerabilities in web applications using HTTP/2 single-packet techniques.

3.3k|507|Updated May 5, 2026

Search Tags:#concurrency #security-testing #TOCTOU #bug-bounty #race-condition #http2 #single-packet

Ready to run

npx skills add https://github.com/elementalsouls/Claude-BugHunter --skill hunt-race-condition-elementalsouls

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: hunt-race-condition
Source: https://github.com/elementalsouls/Claude-BugHunter/tree/main/skills/hunt-race-condition
Command: npx skills add https://github.com/elementalsouls/Claude-BugHunter --skill hunt-race-condition-elementalsouls

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

Race-condition vulnerabilities in web applications, including timing-based bypasses and TOCTOU issues, can be hidden in complex multi-step flows; this Skill provides methods to identify, reproduce, and validate those races using HTTP/2 single-packet techniques and parallel-request tooling.

Core Features & Use Cases

Comprehensive race-hunting playbook covering HTTP/2 single-packet attacks, TOCTOU windows, and MFA timing races.
Practical endpoints and patterns: rate-limit bypass, coupon double-redemption, gift-card double-spend, account-create races, email-activation races, and other disclosed-vulnerability patterns.
Step-by-step hunting methodology from baseline to exploit confirmation, enabling reproducible results across platforms.
Use Case: Validate a race on a login/checkout endpoint by executing multiple parallel requests and measuring duplicate successes within a tightened window.

Quick Start

To begin, run parallel requests against a target endpoint to validate race-condition vulnerabilities using HTTP/2 single-packet techniques.

Frequently Asked Questions about hunt-race-condition

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I test race conditions using HTTP/2 single-packet attacks?▼

Race conditions are tested using HTTP/2 single-packet attacks by issuing parallel requests within a tightened window to validate duplicate successes. This technique targets TOCTOU vulnerabilities and timing-based bypasses in multi-step web application flows.

What types of race condition vulnerabilities can be exploited in web applications?▼

Race condition vulnerabilities in web applications include coupon double-redemption, gift-card double-spend, MFA timing races, account-create races, email-activation races, vote inflation, password-reset token races, and rate-limit bypass under concurrent requests.

How do I reproduce TOCTOU timing bypasses in multi-step authentication flows?▼

TOCTOU timing bypasses in multi-step authentication flows are reproduced by following a step-by-step hunting methodology from baseline to exploit confirmation, executing parallel requests against target endpoints to measure duplicate successes within tightened concurrent windows.

Can I use HTTP/2 multiplexing to bypass rate limits on concurrent requests?▼

HTTP/2 multiplexing can bypass rate limits on concurrent requests by leveraging single-packet techniques to issue simultaneous parallel requests. This targets timing windows in rate-limit enforcement logic across web application endpoints.

Do I need prior knowledge of concurrency and HTTP/2 to hunt for race conditions?▼

Hunting for race conditions requires knowledge of concurrency, HTTP/2 multiplexing, safe testing practices, and practical tooling for issuing parallel requests and capturing reproducible results across targeted web application platforms.

Why does my race condition exploit fail to trigger on coupon double-redemption endpoints?▼

Race condition exploits on coupon double-redemption endpoints fail when parallel requests are not synchronized within a tightened single-packet window. Reproducible results require measuring duplicate successes against the exact TOCTOU timing vulnerability.