Hunting Race Conditions

A hunting playbook for race-condition / TOCTOU vulnerabilities, built from 12 public bug-bounty and coordinated-disclosure cases. Race conditions are high-severity because they break the financial, access-control, and integrity assumptions defenders rarely stress-test: double-spending credits, inflating votes, bypassing per-user limits, and racing token/state transitions. The enabling primitive for modern targets is the HTTP/2 single-packet attack, which collapses the race window to sub-millisecond and makes rate-limited, distributed, load-balanced backends race-able.

Quick-start

1. Enumerate one-time / limited-use actions — every endpoint enforcing "once per user", "limited quantity", or "deduct balance". The gap between its state read and state write is your window.
2. Capture a clean baseline request and confirm the expected single-use behaviour.
3. Stage parallel requests — prefer Turbo Intruder Engine.BURP2 (single-packet HTTP/2) when the target advertises h2; otherwise fall back to parallel HTTP/1.1.
4. Fire 10–50 simultaneous requests with last-byte sync, then look for multiple successes, duplicate effects, or stale-state where only one should have won.
5. Verify the effect and reproducibility (3/5 attempts), then run Gate 0 before reporting.

Full detail is loaded on demand — see References.

References

Each file is loaded on demand — read one only when the task needs that depth (progressive disclosure).