web-vuln-race-conditions

What this skill does

Identifies race condition vulnerabilities in web applications by sending concurrent identical requests to stateful endpoints. Detects TOCTOU (time-of-check-time-of-use) flaws, coupon/promo reuse, limit overrun, double-spend, and file upload races by observing whether the application processes multiple simultaneous requests as if each were the only one.

When to use

• When testing endpoints that check a condition then perform an action (balance check → debit, coupon valid → redeem)
• When auditing e-commerce flows: promo codes, gift cards, limited-stock purchases, referral credits
• When checking rate-limit enforcement on sensitive actions (OTP verify, password reset, email change)
• During bug bounty or penetration testing of financial or transactional features

Prerequisites

• curl installed
• GNU parallel installed (apt install parallel or brew install parallel)
• Two test accounts on the target (attacker account with a redeemable asset, e.g. a coupon code)

Inputs

Variable	Description	Example
TARGET_URL	Endpoint to test for race condition	https://example.com/api/coupon/apply
AUTH_TOKEN	Bearer token or session cookie for the test account	eyJhbGci...
REQUEST_BODY	JSON body for the POST request	{"code":"PROMO123"}
CONCURRENCY	Number of simultaneous requests to send	20

Workflow

Step 1: Identify stateful operations

Review the application for endpoints that:

• Check a value then modify it (balance, coupon validity, stock count, rate limit counter)
• Return different results on first vs. subsequent calls (one-time tokens, limited-use codes)
• Touch shared state without explicit atomic operations

Common targets:

POST /api/coupon/apply
POST /api/credits/spend
POST /api/order/place
POST /api/otp/verify
POST /api/transfer
POST /api/promo/redeem

Step 2: Craft the concurrent request burst

TARGET_URL="https://example.com/api/coupon/apply"
AUTH_TOKEN="YOUR_BEARER_TOKEN"
REQUEST_BODY='{"code":"PROMO123"}'
CONCURRENCY=20

# Create a function for a single request
do_request() {
  curl -s -o /tmp/race_response_$1.txt -w "%{http_code}" \
    -X POST "$TARGET_URL" \
    -H "Authorization: Bearer $AUTH_TOKEN" \
    -H "Content-Type: application/json" \
    -d "$REQUEST_BODY"
}
export -f do_request
export TARGET_URL AUTH_TOKEN REQUEST_BODY