race-condition-single-packet

What problem does it solve?

This Skill solves the problem of identifying and exploiting time-of-check-to-time-of-use (TOCTOU) race conditions in web applications that enforce count-gated limits (like resource creation quotas, one-time coupon usage, or balance checks) sequentially without proper locking mechanisms, which allows attackers to bypass these limits during authorized security testing.

Core Features & Use Cases

• Source Code Detection: Provides grep patterns for Rails and Django applications to identify vulnerable count-gated validation logic that lacks database-level locks like SELECT FOR UPDATE or advisory locks.
• Six-Step Exploitation Methodology: Guides users through verifying limit enforcement, preparing headroom for the race, executing the single-packet attack, and confirming the TOCTOU vulnerability to produce valid, actionable bug reports.
• Multiple Exploitation Techniques: Supports true single-packet HTTP/2 attacks via Python h2, Turbo Intruder, Burp Repeater group sends, and HTTP/1.1 parallel curl requests as a fallback for environments without HTTP/2 proxy support.
• Verification & Chaining Guidance: Includes steps to confirm the bypass is a race condition rather than a broken limit, and suggestions for chaining the vulnerability with attacks like billing bypass or event amplification.

Quick Start

Use this skill to scan a target web application's source code for vulnerable count-gated limit patterns, verify the limit works sequentially, and execute a single-packet HTTP/2 race condition to bypass the limit and confirm the TOCTOU vulnerability for a bug bounty report.