skills.rest
DorianGallo
DorianGalloCOMMUNITY
Explore all skills by this author →
GitHub

race-condition

Test web applications for exploitable race conditions using synchronized concurrent requests.

5|2|Updated May 16, 2026
Search Tags:#race condition#TOCTOU#concurrency testing#state integrity#HTTP/2#Turbo Intruder#CWE-362
One-click install
npx skills add https://github.com/DorianGallo/hack-skills-local --skill race-condition-doriangallo
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: race-condition
Source: https://github.com/DorianGallo/hack-skills-local/tree/main/skills/race-condition
Command: npx skills add https://github.com/DorianGallo/hack-skills-local --skill race-condition-doriangallo

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Race conditions let attackers exploit non-atomic check-then-act flows to trigger duplicate effects, bypass rate limits, or desynchronize state such as balances, inventory, and one-time verification actions.

Core Features & Use Cases

  • TOCTOU-focused testing: Pinpoints authorization/state integrity issues where concurrent requests observe stale “checked” state before mutation.
  • High-concurrency transport strategies: Uses synchronized parallel execution (HTTP/1.1 last-byte synchronization, HTTP/2 single-packet bursts, and Turbo Intruder gate patterns) to maximize overlap in the critical window.
  • Evidence-driven confirmation: Guides you to validate with reproducible duplicate successes and server-side artifacts like inconsistent final balances, duplicate ledger rows, or oversold inventory.

Quick Start

Ask the AI to generate a race-condition test plan for a coupon redemption endpoint that can complete in parallel and produce evidence of duplicate ledger entries.

Frequently Asked Questions about race-condition

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for TOCTOU race conditions in web applications?▼

Test TOCTOU race conditions by executing synchronized concurrent requests against check-then-act authorization flows to exploit non-atomic state mutations like duplicate coupon redemption or balance deduction.

How does HTTP/2 single-packet burst testing work for concurrency vulnerabilities?▼

HTTP/2 single-packet bursts synchronize parallel requests to maximize overlap within the critical execution window, exposing duplicate-state races and state integrity flaws during concurrent operations.

Can I use last-byte synchronization techniques to test HTTP/1.1 endpoints for race conditions?▼

HTTP/1.1 last-byte synchronization techniques align parallel request execution to test race conditions, maximizing overlap in the critical window to expose non-atomic authorization checks.

How do I verify and reproduce race condition vulnerabilities after initial detection?▼

Verify race condition vulnerabilities by reproducing duplicate successes and correlating server-side state deltas like inconsistent final balances, duplicate ledger rows, or oversold inventory as evidence.

What types of application flows are most vulnerable to concurrent request race conditions?▼

One-time operations, coupon redemption, quota deduction, referral claims, and multi-step verification pipelines are highly vulnerable to concurrent request race conditions desynchronizing confirm and write stages.

Related Skills

Explore More Software Engineering Skills→
alexfazioalexfazio
159

cc-trace

Intercept and inspect Claude Code API traffic using mitmproxy.

Community
Advanced
cybersecwomancybersecwoman
5

hunt-race-condition

Detect race condition vulnerabilities in software applications using HTTP/2 techniques.

Community
Advanced
vincent119vincent119

go-http-advanced

Configure Go HTTP clients with transport reuse, timeouts, and retry strategies.

Community
Advanced
florianbuetowflorianbuetow
12

race-conditions

Analyze source code for race condition vulnerabilities with CWE references.

Community
Advanced