What problem does it solve? Business-logic endpoints like coupon redemption, withdrawals, and order creation often lack atomicity checks, and manually verifying concurrency flaws is slow and unreliable. This Skill provides a structured methodology and ready-to-adapt concurrent scripts to detect race condition and TOCTOU vulnerabilities during authorized security testing. ## Core Features & Use Cases - Scenario-Classified Testing: Covers eight prioritized scenarios including coupon double-spending, withdrawal/transfer concurrency, inventory overselling, invite code reuse, check-in point duplication, state-transition races, file upload races, and password reset TOCTOU. - Go and Python PoC Templates: Provides concurrent request scripts using Go goroutines and Python asyncio/aiohttp that can be adapted to target endpoints. - Detection Signals and Checklists: Supplies keyword-based endpoint identification (couponCode, withdraw, order, invite, checkin) and a 3-round verification standard with concurrency levels of 10/20/50. - Use Case: During an authorized SRC assessment, JS analysis reveals a /api/coupon/use endpoint. You adapt the Go template to fire 20 concurrent redemption requests and confirm the same coupon was applied multiple times, producing a documented finding. ## Quick Start Ask the agent to run a race condition test against the coupon redemption endpoint using 20 concurrent requests with the test account credentials.
