skills.rest
blacklanternsecurity
blacklanternsecurityOFFICIAL
Explore all skills by this author →
WebsiteGitHub

race-condition

Exploit race conditions and TOCTOU vulnerabilities in web applications.

253|37|Updated Feb 22, 2026
Search Tags:#penetration testing#race condition#web security#TOCTOU#vulnerability exploitation#burpsuite
One-click install
npx skills add https://github.com/blacklanternsecurity/red-run --skill race-condition
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: race-condition
Source: https://github.com/blacklanternsecurity/red-run/tree/main/skills/web/race-condition
Command: npx skills add https://github.com/blacklanternsecurity/red-run --skill race-condition

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps penetration testers identify and exploit race conditions and Time-of-Check to Time-of-Use (TOCTOU) vulnerabilities in web applications, which can lead to unauthorized actions like duplicate coupon redemption or balance overspending.

Core Features & Use Cases

  • Endpoint Identification: Detects endpoints susceptible to race conditions by analyzing their constraint-checking and action-execution patterns.
  • Exploitation Techniques: Implements various synchronization methods, including HTTP/2 single-packet attacks and HTTP/1.1 last-byte synchronization, using tools like Burp Suite's Turbo Intruder and Python.
  • Use Case: A penetration tester suspects a web application's coupon redemption endpoint is vulnerable. They use this Skill to send hundreds of redemption requests simultaneously, successfully applying the same coupon multiple times and confirming the vulnerability.

Quick Start

Use the race-condition skill to test the endpoint 'https://example.com/api/redeem' for coupon reuse vulnerabilities.

Frequently Asked Questions about race-condition

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I exploit a race condition in a web application during penetration testing?▼

Exploit a race condition by identifying endpoints with constraint-checking and action-execution patterns, then sending synchronized concurrent requests using HTTP/2 single-packet or HTTP/1.1 last-byte synchronization to trigger unauthorized actions like duplicate coupon redemption.

What is a TOCTOU vulnerability and how does synchronization test for it?▼

A TOCTOU vulnerability is a Time-of-Check to Time-of-Use flaw where an application verifies a constraint before executing an action. Synchronization tests for it by sending simultaneous requests to bypass authentication or rate limits during the gap between check and use.

Can I use Burp Suite and Python to perform HTTP/2 single-packet attacks?▼

Yes, you can use Burp Suite's Turbo Intruder and Python to perform HTTP/2 single-packet attacks. This synchronization technique sends multiple concurrent requests within a single network packet to reliably test for limit overruns and rate limit bypasses.

What is the best way to test an API endpoint for rate limit bypasses?▼

Test an API endpoint for rate limit bypasses by analyzing its constraint-checking patterns and employing HTTP/1.1 last-byte synchronization or HTTP/2 single-packet attacks to send hundreds of simultaneous requests, effectively bypassing sequential rate enforcement.

When should I use HTTP/2 single-packet instead of HTTP/1.1 last-byte synchronization?▼

Use HTTP/2 single-packet synchronization for precise concurrent delivery in modern web applications, while HTTP/1.1 last-byte synchronization is employed when testing legacy endpoints that do not support HTTP/2 multiplexing during authorized penetration testing.

Related Skills

Explore More Software Engineering Skills→
giosuetedeschi-specgiosuetedeschi-spec

Burp Suite Web Application Testing

Intercept and modify HTTP traffic to test web application security.

Community
Advanced
sayseven7sayseven7
11

race-condition

Test web applications for race conditions and TOCTOU flaws with synchronized request bursts.

Community
Advanced
din4edin4e
2

race-condition

Identify and exploit race-condition vulnerabilities in web applications.

Community
Advanced
SnailSploitSnailSploit
2.9k

race-condition

Detect TOCTOU vulnerabilities by sending concurrent requests to web application endpoints.

Community
Advanced