skills.rest
dreadnode
dreadnodeOFFICIAL
Explore all skills by this author →
Website𝕏@dreadnodeGitHub

race-condition-single-packet

Detect and exploit TOCTOU race conditions in count-gated web operations.

11|1|Updated May 4, 2026
Search Tags:#race condition#web security#toctou#red teaming#http/2#limit bypass
One-click install
npx skills add https://github.com/dreadnode/capabilities --skill race-condition-single-packet
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: race-condition-single-packet
Source: https://github.com/dreadnode/capabilities/tree/main/capabilities/web-security/skills/race-condition-single-packet
Command: npx skills add https://github.com/dreadnode/capabilities --skill race-condition-single-packet

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill solves the problem of identifying and exploiting time-of-check-to-time-of-use (TOCTOU) race conditions in web applications that enforce count-gated limits (like resource creation quotas, one-time coupon usage, or balance checks) sequentially without proper locking mechanisms, which allows attackers to bypass these limits during authorized security testing.

Core Features & Use Cases

  • Source Code Detection: Provides grep patterns for Rails and Django applications to identify vulnerable count-gated validation logic that lacks database-level locks like SELECT FOR UPDATE or advisory locks.
  • Six-Step Exploitation Methodology: Guides users through verifying limit enforcement, preparing headroom for the race, executing the single-packet attack, and confirming the TOCTOU vulnerability to produce valid, actionable bug reports.
  • Multiple Exploitation Techniques: Supports true single-packet HTTP/2 attacks via Python h2, Turbo Intruder, Burp Repeater group sends, and HTTP/1.1 parallel curl requests as a fallback for environments without HTTP/2 proxy support.
  • Verification & Chaining Guidance: Includes steps to confirm the bypass is a race condition rather than a broken limit, and suggestions for chaining the vulnerability with attacks like billing bypass or event amplification.

Quick Start

Use this skill to scan a target web application's source code for vulnerable count-gated limit patterns, verify the limit works sequentially, and execute a single-packet HTTP/2 race condition to bypass the limit and confirm the TOCTOU vulnerability for a bug bounty report.

Frequently Asked Questions about race-condition-single-packet

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
What is a TOCTOU race condition in count-gated web application limits?▼

A TOCTOU race condition occurs when count-gated limits like resource quotas or one-time token validation enforce checks sequentially without database-level locking, allowing concurrent requests to bypass the limit window during the time-of-check-to-time-of-use gap.

How do I exploit an HTTP/2 single-packet race condition to bypass a web application limit?▼

You exploit an HTTP/2 single-packet race condition by preparing request headroom, verifying sequential limit enforcement, sending concurrent requests within a single TCP packet to trigger the TOCTOU window, and confirming the limit bypass for your bug bounty report.

Can I detect vulnerable count-gated validation logic in Rails and Django source code?▼

Yes, you can detect vulnerable count-gated validation logic in Rails and Django source code using provided grep patterns to identify sequential limit checks that lack proper database-level locking mechanisms like SELECT FOR UPDATE or advisory locks.

Does the single-packet race condition attack work without HTTP/2 proxy support?▼

If HTTP/2 proxy support is unavailable, you can fall back to HTTP/1.1 parallel curl requests to attempt the race condition attack, though true single-packet delivery via Python h2 or Turbo Intruser is the preferred method for reliable exploitation.

How do I verify a limit bypass is a race condition rather than broken limit enforcement?▼

You verify a race condition bypass by first confirming the limit functions correctly under sequential requests, then executing the single-packet attack to demonstrate the bypass only occurs under concurrent request conditions, differentiating it from broken limit logic.

What can I chain a count-gated race condition bypass with for further exploitation?▼

After confirming a count-gated race condition bypass, you can chain the vulnerability with attacks like billing bypass or event amplification to escalate the security impact and demonstrate broader exploitation potential in your authorized red teaming report.

Related Skills

Explore More Software Engineering Skills→
brainbrewlabsbrainbrewlabs
7

security-auditor

Scan codebases for security vulnerabilities and secret leaks.

Official
Intermediate
0xhaaz0xhaaz

security-arsenal

Provide security payloads, bypass tables, and submission rules for bug bounty hunting.

Community
Advanced
ok-helloworldok-helloworld
241

race-condition

Detect race-condition and TOCTOU vulnerabilities via synchronized parallel HTTP requests.

Community
Advanced
chatbotkitchatbotkit
13

hunt-race-condition

Identifies and exploits web race conditions using parallel requests.

Official
Advanced