skills.rest
inventashif
inventashifCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hunt-race-condition

Detect and exploit race condition vulnerabilities using HTTP/2 single-packet attack techniques.

Updated Sep 6, 2026
Search Tags:#race condition#web security#bug bounty#toctou#vulnerability hunting#turbo intruder#http/2 single-packet
One-click install
npx skills add https://github.com/inventashif/helpful-code-sidekick --skill hunt-race-condition-inventashif
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-race-condition
Source: https://github.com/inventashif/helpful-code-sidekick/tree/main/scripts/hackerai/skills/bughunter/hunt-race-condition
Command: npx skills add https://github.com/inventashif/helpful-code-sidekick --skill hunt-race-condition-inventashif

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Race condition and TOCTOU vulnerabilities are hard to find because sequential testing never triggers them; this Skill provides a structured methodology, tooling guidance, and real disclosed-report patterns to reliably identify and prove race conditions during bug bounty hunting. ## Core Features & Use Cases - Parallel Request Tooling: Covers Burp Repeater "Send group in parallel", Turbo Intruder with Engine.BURP2, curl backgrounding, and Python asyncio for firing synchronized request batches. - HTTP/2 Single-Packet Attack Reference: Explains last-byte-sync, race-window estimation, Wireshark validation, and Flatt Security's first-sequence-sync extension for up to 10,000 concurrent requests. - Target Enumeration & Root-Cause Analysis: Lists high-value endpoint patterns (coupon redemption, voting, MFA/OTP validation, gift cards, faucet minting), defense bypass techniques, and grep patterns for auditing Rails, Node.js, PHP, and Django codebases. - Use Case: While testing an e-commerce target, capture a gift-card redemption request, fire 20 identical copies via a single HTTP/2 packet, and confirm the balance is credited multiple times to demonstrate a double-spend vulnerability. ## Quick Start Use the hunt-race-condition skill to test this coupon redemption endpoint for a double-redemption race condition using parallel requests.

Frequently Asked Questions about hunt-race-condition

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for race condition vulnerabilities in a web application?▼

Capture a legitimate single-use request (like a coupon redemption), then fire 10-50 identical copies simultaneously using Burp Repeater's "Send group in parallel" or Turbo Intruder. Success means two or more requests return 2xx when only one should succeed.

What is the HTTP/2 single-packet attack for race conditions?▼

The single-packet attack, published by James Kettle at DEF CON 31, pre-stages N requests on one HTTP/2 connection by withholding the last byte of each, then releases all final bytes in one TCP write. This collapses the race window to under 1 ms, making exploits viable against modern load-balanced backends.

Which endpoints are most likely to have race condition bugs?▼

Target one-time or limited-use actions: /redeem, /apply-coupon, /vote, /purchase, /transfer, /invite, and /activate endpoints. Any feature enforcing "once per user" or balance deduction with a read-then-write pattern is a prime candidate.

Does the single-packet attack work if the server doesn't support HTTP/2?▼

No, single-packet requires HTTP/2, which you can verify with curl -sI --http2. For HTTP/1.1-only targets, fall back to parallel pipelining over multiple connections, though the race window widens to 5-50 ms and success rates drop against modern backends.

Why do race condition exploits fail even with parallel requests?▼

Failures usually come from network jitter spreading requests across milliseconds, or server-side serialization by the worker pool. Verify delivery with Wireshark: all END_STREAM frames should appear in one TLS record and one TCP segment, otherwise your tool is sequencing requests.

How do I prove a race condition is exploitable for a bug bounty report?▼

Demonstrate concrete impact: show the vote count incremented multiple times, credit balance doubled, or a one-time coupon redeemed twice. Confirm reproducibility with a short script succeeding at least 3 out of 5 attempts on a fresh account before reporting.

Related Skills

Explore More Software Engineering Skills→
zebbernzebbern
4.5k

Burp Suite Web Application Testing

Automate Burp Suite web application security testing across intercept, modify, scan, and manual workflows.

Community
Advanced
Wyl-cmdWyl-cmd
6

report-writing

Writes impact-first bug bounty reports for HackerOne, Bugcrowd, Intigriti, and Immunefi.

Community
Intermediate
yanko-belovyanko-belov
13

race-conditions

Identify and mitigate race conditions using atomic operations and synchronization patterns.

Community
Advanced
EntroVyxEntroVyx
3

hunt-business-logic

Identifies and validates business logic vulnerabilities in web applications.

Community
Advanced