hunt-race-condition

Race conditions are tested using HTTP/2 single-packet attacks by issuing parallel requests within a tightened window to validate duplicate successes. This technique targets TOCTOU vulnerabilities and timing-based bypasses in multi-step web application flows.

Race condition vulnerabilities in web applications include coupon double-redemption, gift-card double-spend, MFA timing races, account-create races, email-activation races, vote inflation, password-reset token races, and rate-limit bypass under concurrent requests.

TOCTOU timing bypasses in multi-step authentication flows are reproduced by following a step-by-step hunting methodology from baseline to exploit confirmation, executing parallel requests against target endpoints to measure duplicate successes within tightened concurrent windows.

HTTP/2 multiplexing can bypass rate limits on concurrent requests by leveraging single-packet techniques to issue simultaneous parallel requests. This targets timing windows in rate-limit enforcement logic across web application endpoints.

Hunting for race conditions requires knowledge of concurrency, HTTP/2 multiplexing, safe testing practices, and practical tooling for issuing parallel requests and capturing reproducible results across targeted web application platforms.

Race condition exploits on coupon double-redemption endpoints fail when parallel requests are not synchronized within a tightened single-packet window. Reproducible results require measuring duplicate successes against the exact TOCTOU timing vulnerability.