skills.rest
langbyyi
langbyyiCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

race-condition

Identify race condition and TOCTOU vulnerabilities in web application state-changing operations.

96|1|Updated Jun 4, 2026
Search Tags:#web-security#penetration-testing#race-condition#vulnerability-assessment#toctou#turbo-intruder#concurrent-request
One-click install
npx skills add https://github.com/langbyyi/CyberStrikeAI-SRC --skill race-condition-langbyyi
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: race-condition
Source: https://github.com/langbyyi/CyberStrikeAI-SRC/tree/main/skills/race-condition
Command: npx skills add https://github.com/langbyyi/CyberStrikeAI-SRC --skill race-condition-langbyyi

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill addresses the risk of undetected race condition and time-of-check to time-of-use (TOCTOU) vulnerabilities in web applications, which can lead to unauthorized state changes such as duplicate redemptions, balance overdraws, or bypassed security controls during authorized security testing.

Core Features & Use Cases

  • Attack Pattern Playbooks: Step-by-step guidance for testing one-time operations, balance/quota deductions, rate-limited endpoints, and verification flows.
  • Synchronization Techniques: Instructions for HTTP/1.1 last-byte sync, HTTP/2 single-packet attacks, and Turbo Intruder gate patterns to align parallel requests for consistent timing.
  • Validation & Evidence: Checklists for confirming reproducible race conditions, plus a real-world CVE reference for email forgery via race conditions. Common use cases include testing coupon redemption systems, inventory management APIs, password reset flows, and login rate limits for authorized penetration testing engagements.

Quick Start

Use the race-condition skill to test the /api/v1/rewards/claim endpoint for duplicate redemption vulnerabilities by sending 50 parallel authenticated requests and checking for multiple success responses or duplicate ledger entries.

Frequently Asked Questions about race-condition

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for race condition vulnerabilities in web applications?▼

To test for race condition vulnerabilities, send parallel authenticated requests to state-changing endpoints and check for duplicate successes. This skill provides attack playbooks and synchronization techniques to validate concurrent request flaws.

What is a TOCTOU vulnerability and how does it affect web security?▼

A TOCTOU vulnerability occurs when a system's state changes between a check and its corresponding use, allowing unauthorized actions. This skill helps identify these flaws during authorized penetration testing of verification workflows.

How do I synchronize concurrent requests for reliable penetration testing?▼

To synchronize concurrent requests, use HTTP/1.1 last-byte sync or HTTP/2 single-packet attacks. This skill provides synchronization techniques to align parallel requests for consistent timing during vulnerability assessment.

Can I use Turbo Intruder to test one-time redemption endpoints?▼

Yes, Turbo Intruder gate patterns are supported for testing one-time redemption endpoints. This skill provides attack templates to send parallel requests and identify duplicate redemptions or balance overdraws.

What is the best way to validate a race condition bug?▼

The best way to validate a race condition bug is to check for reproducible duplicate ledger entries or multiple success responses. This skill offers evidence checklists to confirm consistent race condition reproduction.

Does race condition testing work on rate-limited endpoints?▼

Yes, race condition testing works on rate-limited endpoints by sending synchronized parallel requests to bypass security controls. This skill includes specific attack playbooks for testing login rate limits and verification flows.

Related Skills

Explore More Software Engineering Skills→
ok-helloworldok-helloworld
241

csrf-cross-site-request-forgery

Test state-changing endpoints for CSRF weaknesses and anti-CSRF controls.

Community
Advanced
riparinoriparino
1

offensive-race-condition

Coordinate parallel requests to identify and exploit race conditions in web applications.

Community
Advanced
chatbotkitchatbotkit
13

hunt-race-condition

Identifies and exploits web race conditions using parallel requests.

Official
Advanced
ToanPV90ToanPV90

sast-scanning

Detects source code vulnerabilities via static analysis with JSON/SARIF outputs.

Community
Advanced