race-condition

To test for race conditions in web apps, send parallel HTTP requests against state-changing API endpoints to observe non-atomic reads and writes, then document any duplicate state changes. This identifies CWE-362 synchronization gaps in one-time operations.

A TOCTOU vulnerability occurs when a system checks a state before acting, but that state changes before the action completes. You exploit it by coordinating concurrent requests to abuse non-atomic read-then-write operations in multi-step workflows.

Yes, you can use concurrent HTTP requests to bypass rate limits and duplicate one-time claims. By executing parallel requests simultaneously, you can exploit synchronization gaps in authorization and state-integrity checks for coupons or balance updates.

Validate race condition findings by collecting evidence of duplicate effects and cross-referencing them with backend logs and database state. This confirms the final inconsistent state caused by parallel requests during one-time operations or multi-step pipelines.

HTTP/2 single-packet attacks work for testing TOCTOU patterns in APIs by coordinating parallel requests over a single network packet. This technique increases the precision of concurrent HTTP abuse to trigger non-atomic read-then-write synchronization gaps.