skills.rest
chatbotkit
chatbotkitOFFICIAL
Explore all skills by this author →
WebsiteGitHub

hunt-race-condition

Identifies and exploits web race conditions using parallel requests.

13|2|Updated Jun 1, 2026
Search Tags:#concurrency#security-testing#bug-bounty#race-condition#http2#toctou#single-packet
One-click install
npx skills add https://github.com/chatbotkit/rook --skill hunt-race-condition-chatbotkit
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-race-condition
Source: https://github.com/chatbotkit/rook/tree/main/skills/hunt-race-condition
Command: npx skills add https://github.com/chatbotkit/rook --skill hunt-race-condition-chatbotkit

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Hunting race conditions in web applications to identify TOCTOU vulnerabilities and timing-based flaws that enable duplicate actions or state desynchronization.

Core Features & Use Cases

  • Step-by-step methodology to map race windows, prepare parallel requests, and validate exploitability across modern HTTP/2 single-packet techniques.
  • Guidance anchored in real-world bug-bounty cases (coupon redemption, MFA timing, account creation, rate-limiting bypass) to illustrate practical attack surfaces.

Quick Start

Identify a target endpoint, set up parallel requests using your preferred tool, and observe whether the same action can succeed more than once under high concurrency.

Frequently Asked Questions about hunt-race-condition

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I hunt for race conditions in web applications?▼

Hunt for race conditions by mapping timing windows, preparing parallel requests, and validating exploitability using HTTP/2 single-packet techniques to expose unsafe concurrent state transitions.

What is a TOCTOU vulnerability and how does single-packet attack exploit it?▼

A TOCTOU vulnerability occurs when unsafe concurrent state transitions happen between check and use. HTTP/2 single-packet attacks exploit this by sending parallel requests simultaneously to trigger duplicate actions.

Can I use Turbo Intruder and Python asyncio to test MFA timing races?▼

Yes, you can use Turbo Intruder, curl, or Python asyncio to send parallel requests and test MFA timing races, coupon redemption, and account creation flows for concurrency flaws.

How do I bypass rate limits using concurrent HTTP requests?▼

Bypass rate limits by sending highly concurrent HTTP/2 single-packet requests, exploiting timing windows where the server fails to synchronize state fast enough to enforce restrictions.

What is the best way to test coupon redemption for duplicate action vulnerabilities?▼

Test coupon redemption by targeting the endpoint with parallel requests using Turbo Intruder or Python asyncio, observing if high concurrency allows the same redemption action to succeed multiple times.

Do I need authorization before testing endpoints for race conditions?▼

Yes, you need explicit authorization and must follow guidelines before accessing in-scope endpoints, as race condition testing involves sending aggressive parallel requests to identify exploitability.

Related Skills

Explore More Software Engineering Skills→
baasith6baasith6

api-smoke-testing

Analyze codebase routes and execute HTTP requests to test API endpoints.

Community
Intermediate
harperaaharperaa
15

business-logic-flaws-ai-generated-code

Detect race conditions and business-logic vulnerabilities in AI-generated code.

Community
Intermediate
ok-helloworldok-helloworld
241

race-condition

Detect race-condition and TOCTOU vulnerabilities via synchronized parallel HTTP requests.

Community
Advanced
EntroVyxEntroVyx
3

hunt-race-condition

Orchestrate concurrent HTTP/2 requests to detect race condition vulnerabilities.

Community
Advanced