skills.rest
brukal001
brukal001COMMUNITY
Explore all skills by this author →
GitHub

race-condition

Tests web applications for race condition and TOCTOU vulnerabilities using concurrent request techniques.

Updated Jun 26, 2026
Search Tags:#penetration testing#concurrency#race condition#web security#TOCTOU#Burp Suite#timing attack
One-click install
npx skills add https://github.com/brukal001/brukal --skill race-condition-brukal001
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: race-condition
Source: https://github.com/brukal001/brukal/tree/main/skills/claude-red/web/offensive-race-condition
Command: npx skills add https://github.com/brukal001/brukal --skill race-condition-brukal001

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Web applications often fail to synchronize concurrent operations, allowing attackers to bypass business logic through timing attacks like double-spending, coupon reuse, and rate limit bypass. This Skill provides a structured checklist to systematically identify and exploit these race condition vulnerabilities during authorized security testing. ## Core Features & Use Cases - Vulnerability Identification: Target state-changing operations like financial transactions, coupon redemption, and registration flows prone to TOCTOU bugs. - Testing Techniques: Apply Turbo Intruder single-packet attacks, last-byte sync, thread synchronization, and HTTP/2 multiplexing for microsecond-precision concurrency. - Use Case: During a bug bounty engagement on an e-commerce site, use this Skill to test whether a single-use discount coupon can be redeemed multiple times by sending 20 simultaneous checkout requests with Burp Suite's parallel send feature. ## Quick Start Use the race-condition skill to test the coupon redemption endpoint on my authorized target for concurrent request vulnerabilities.

Frequently Asked Questions about race-condition

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for race conditions in web applications?▼

Identify state-changing endpoints like payments or coupon redemption, then send 10-100 identical requests simultaneously using Burp Suite Turbo Intruder or Python threading scripts. Observe whether the application processes multiple requests that should only succeed once, such as applying the same discount twice.

What tools work best for race condition testing?▼

Burp Suite 2023.9+ offers single-packet attack mode in Repeater for microsecond-precision concurrency. Turbo Intruder provides high-volume parallel requests with gate synchronization, while custom Python scripts using threading or asyncio offer flexible automation for API endpoints.

Can race conditions bypass rate limiting?▼

Yes, race conditions can bypass rate limits when counters are checked before being incremented atomically. Send concurrent login attempts or OTP requests across multiple sessions to test whether the application enforces limits globally or allows burst exploitation within the check window.

Why do race condition attacks fail on some applications?▼

Attacks fail when applications use database transactions with SERIALIZABLE isolation, row-level locking with SELECT FOR UPDATE, or idempotency keys. Network latency between your testing infrastructure and the target server also reduces the chance of hitting the vulnerable timing window.

What is the difference between TOCTOU and regular race conditions?▼

TOCTOU (time-of-check-to-time-of-use) is a specific race condition where a security check occurs but circumstances change before the result is used. Regular race conditions include any concurrent access flaw, such as read-modify-write conflicts on shared resources without proper synchronization.

Related Skills

Explore More Software Engineering Skills→
mejangomejango

burp-suite

Identify web application vulnerabilities using Burp Suite Proxy, Repeater, and Intruder.

Community
Advanced
kaminocorpkaminocorp
1

exploit-development

Develops proof-of-concept exploits for verified vulnerabilities in authorized security testing.

Official
Advanced
lNwNllNwNl

business-logic-vulnerabilities

Tests web applications for business logic flaws including race conditions, price manipulation, and workflow bypass.

Community
Advanced
anderskevanderskev
75

postgres-code-review

Review PostgreSQL code for indexing, JSONB usage, and transaction safety.

Community
Intermediate