Exploiting Race Condition Vulnerabilities

When to Use

• When testing applications with transaction-based functionality (payments, transfers, coupons)
• During assessment of rate-limiting or attempt-limiting mechanisms
• When testing multi-step workflows (registration, password reset, MFA)
• During bug bounty hunting for logic flaws in state-changing operations
• When evaluating applications with inventory or balance management systems

Prerequisites

• Burp Suite Professional with Turbo Intruder extension installed
• Understanding of HTTP/2 single-packet attack technique
• Python scripting ability for custom Turbo Intruder scripts
• Knowledge of TOCTOU (Time-of-Check-to-Time-of-Use) vulnerabilities
• Target application with state-changing operations (purchases, votes, transfers)
• Multiple user accounts for testing cross-user race conditions

Workflow