skills.rest
Yliken
YlikenCOMMUNITY
Explore all skills by this author →
GitHub

race-condition

Identify and test race conditions and TOCTOU bugs in web applications.

5|1|Updated Apr 20, 2026
Search Tags:#concurrency#web-security#security-testing#race-condition#http2#toctou
One-click install
npx skills add https://github.com/Yliken/ai4 --skill race-condition-yliken
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: race-condition
Source: https://github.com/Yliken/ai4/tree/main/skills/race-condition
Command: npx skills add https://github.com/Yliken/ai4 --skill race-condition-yliken

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Race conditions cause non-atomic sequences where reads and updates interleave, enabling stale-state observations. This Skill guides safe testing for web apps to detect TOCTOU and synchronization gaps that may lead to inconsistent outcomes.

Core Features & Use Cases

  • TOCTOU testing concepts and practical attack patterns for concurrent operations.
  • HTTP/1.1 last-byte synchronization, HTTP/2 single-packet timing, and Turbo Intruder gate techniques.
  • Real-world scenarios include one-time redemptions, balance updates, and multi-step workflows.

Quick Start

Provide a controlled, authorized test harness that targets non-atomic check-then-update paths and measures duplicate successes and inconsistent final states.

Frequently Asked Questions about race-condition

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test race conditions in web applications?▼

To test race conditions in web applications, you exploit non-atomic read-then-write sequences by sending concurrent HTTP requests to one-time operations or multi-step workflows, measuring duplicate successes or inconsistent final states.

What is a TOCTOU bug and how does it affect concurrency?▼

A TOCTOU bug is a concurrency flaw where non-atomic read-then-write sequences interleave, enabling stale-state observations and synchronization gaps that cause inconsistent outcomes in web applications.

What's the best way to synchronize concurrent HTTP requests for security testing?▼

For race condition testing, the best way to synchronize concurrent requests is using HTTP/1.1 last-byte synchronization, HTTP/2 single-packet timing, or Turbo Intruder gate techniques to align request delivery.

Can I use concurrent requests to bypass rate limiting or redeem one-time bonuses?▼

Yes, you can target rate-limiting gaps and one-time redemptions by sending concurrent HTTP requests to exploit non-atomic check-then-update paths, validating state integrity by measuring duplicate successes.

How do I safely test race conditions on multi-step pay and confirm workflows?▼

To safely test race conditions on multi-step pay/confirm workflows, provide a controlled, authorized test harness that targets non-atomic sequences, enforcing safe testing practices while capturing inconsistent final states.

Related Skills

Explore More Software Engineering Skills→
ok-helloworldok-helloworld
241

race-condition

Detect race-condition and TOCTOU vulnerabilities via synchronized parallel HTTP requests.

Community
Advanced
sayseven7sayseven7
11

race-condition

Test web applications for race conditions and TOCTOU flaws with synchronized request bursts.

Community
Advanced
DorianGalloDorianGallo
5

race-condition

Test web applications for exploitable race conditions using synchronized concurrent requests.

Community
Advanced
harperaaharperaa
15

business-logic-flaws-ai-generated-code

Detect race conditions and business-logic vulnerabilities in AI-generated code.

Community
Intermediate