hunt-race-condition

Identify race conditions by orchestrating concurrent requests against target endpoints to observe non-atomic state transitions. This Skill scripts multi-client scenarios using deterministic tooling to reproduce duplicate coupon redemptions or MFA timing bypasses.

TOCTOU race conditions exploit delays between checking and using state, while HTTP/2 single-packet attacks send concurrent requests over one TLS connection to force non-atomic state transitions and bypass one-off constraints like token verification.

Yes, uncovering race conditions requires knowledge of HTTP/2, TLS, and database isolation levels. Understanding backend stacks helps script multi-client scenarios and recognize countermeasures like atomic updates and row-level locks.

Common race condition attack surfaces include coupon redemption, MFA timing, account creation, and token verification flows. These endpoints often fail to enforce atomic state transitions under concurrent request loads.

Document race conditions using reproducible testing workflows and evidence templates that demonstrate concurrent success signals. This structured methodology proves non-atomic state transitions and demonstrates impact to stakeholders.

Mitigations against race condition exploitation include implementing atomic updates and applying row-level database locks. These countermeasures ensure state transitions remain atomic even when processing concurrent HTTP/2 requests.