hunt-race-condition

Name: hunt-race-condition
Availability: InStock
Author: pdparchitect

Analyze web application endpoints for TOCTOU race condition vulnerabilities.

13|2|Updated Jun 1, 2026

Search Tags:#security-audit #bug-hunting #race-condition #vulnerability-research #http2 #toctou

Ready to run

npx skills add https://github.com/pdparchitect/rook --skill hunt-race-condition-pdparchitect

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: hunt-race-condition
Source: https://github.com/pdparchitect/rook/tree/main/skills/hunt-race-condition
Command: npx skills add https://github.com/pdparchitect/rook --skill hunt-race-condition-pdparchitect

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill addresses the difficulty of identifying and exploiting race conditions, which are high-severity vulnerabilities that occur when non-atomic operations allow multiple requests to manipulate state simultaneously.

Core Features & Use Cases

Methodology Guidance: Provides a comprehensive, step-by-step framework for mapping state machines and identifying TOCTOU (Time-of-Check to Time-of-Use) windows.
Exploitation Techniques: Offers advanced strategies for parallel request execution, including HTTP/2 single-packet attacks and last-byte synchronization.
Use Case: Use this skill to audit financial systems, coupon redemption flows, or voting mechanisms for vulnerabilities where concurrent requests could lead to double-spending or unauthorized privilege escalation.

Quick Start

Use the hunt-race-condition skill to analyze the target endpoint for race conditions using a parallel request strategy.

Frequently Asked Questions about hunt-race-condition

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect race condition vulnerabilities in web applications?▼

Detect race condition vulnerabilities by mapping non-atomic state transitions where concurrent requests manipulate application state simultaneously. This skill targets high-value endpoints like financial transactions to identify unsafe concurrent execution paths.

What is a TOCTOU flaw and how do I identify it during a security audit?▼

A TOCTOU flaw is a Time-of-Check to Time-of-Use vulnerability where non-atomic operations allow state changes between validation and execution. This skill provides a step-by-step framework to map state machines and identify these timing windows.

How can I use HTTP/2 single-packet attacks to exploit race conditions?▼

Exploit race conditions using HTTP/2 single-packet synchronization to send multiple concurrent requests reliably. This advanced technique ensures parallel execution to trigger TOCTOU flaws that traditional sequential testing often misses.

Can I audit coupon redemption flows for double-spending vulnerabilities?▼

Yes, you can audit coupon redemption flows for double-spending vulnerabilities by analyzing concurrent request handling. This skill specifically targets coupon and financial systems to identify non-atomic state transitions.

What is the best way to test high-value endpoints for concurrent request vulnerabilities?▼

The best way to test high-value endpoints for concurrent request vulnerabilities is using advanced parallel request techniques like last-byte synchronization. This approach reliably triggers race conditions in financial and account management systems.

Why does parallel request testing fail to trigger race conditions in some applications?▼

Parallel request testing fails when requests are not synchronized precisely enough to hit the TOCTOU window. This skill uses HTTP/2 single-packet attacks to overcome timing limitations and ensure reliable concurrent execution.