race-condition

Identify state-changing endpoints like payments or coupon redemption, then send 10-100 identical requests simultaneously using Burp Suite's single-packet attack or Turbo Intruder. Compare the resulting application state against expected behavior to detect double-processing.

Burp Suite Repeater (2023.9+) with Send Parallel mode and Turbo Intruder are the primary tools. Alternatives include Racepwn, Race-the-Web, and custom scripts using Python threading, asyncio, or Go goroutines for synchronized request floods.

The single-packet attack uses HTTP/2 multiplexing to deliver multiple requests within microseconds, achieving under 4ms skew. It completes all request bytes in one TCP packet, eliminating network jitter that ruins traditional multi-threaded race attempts.

Yes, concurrent login or OTP requests can hit shared counters before they increment, allowing more attempts than intended. Test global versus per-user versus per-IP buckets with both burst and sustained parallel request patterns.

Races are timing-dependent, so network latency, server load, and session locking (like PHP session file locks) reduce success rates. Use multiple sessions, minimize latency with a nearby VPS, and repeat attacks with varying concurrency levels.

Yes, concurrent Lambda invocations can process the same event in parallel, enabling coupon reuse or double redemption. Test with ThreadPoolExecutor invoking the function 50 times simultaneously and check whether DynamoDB conditional writes or idempotency keys prevent duplication.