hunt-race-condition

Identify endpoints enforcing one-time or limited-use constraints, capture a baseline request, then fire 10-50 identical requests simultaneously using Turbo Intruder, curl backgrounding, or Python asyncio. Verify the effect by checking whether credits, votes, or redemptions were applied multiple times.

The single-packet attack, published by James Kettle at DEF CON 31, pre-stages multiple HTTP/2 requests by withholding the final byte of each, then releases all final bytes in one TCP write. This collapses the race window to under 1 ms, making exploits viable against modern load-balanced backends.

Target endpoints handling coupon redemption, gift cards, voting, balance transfers, account activation, invites, and resource creation limits. Any endpoint with a check-then-act pattern, where state is read and then written in separate operations, is a candidate.

No, single-packet delivery requires HTTP/2 multiplexing over one connection. Verify support with curl --http2; on HTTP/1.1-only targets, fall back to parallel pipelining, which has a much wider race window and only works against slower backends.

Common causes include network jitter spreading requests across milliseconds, server-side serialization by the worker pool, or requests exceeding the MTU and fragmenting. Use Wireshark to confirm all requests arrive in one TCP segment, and estimate the race window before attacking.

Demonstrate the duplicate effect with concrete evidence such as double-credited balances or inflated vote counts, show measurable victim impact, and reproduce the result in at least 3 of 5 attempts from a fresh account with a short script.