web-vuln-race-conditions

What this skill does

Identifies race condition vulnerabilities in web applications by sending concurrent identical requests to stateful endpoints. Detects TOCTOU (time-of-check-time-of-use) flaws, coupon/promo reuse, limit overrun, double-spend, and file upload races by observing whether the application processes multiple simultaneous requests as if each were the only one.

When to use

• When testing endpoints that check a condition then perform an action (balance check → debit, coupon valid → redeem)
• When auditing e-commerce flows: promo codes, gift cards, limited-stock purchases, referral credits
• When checking rate-limit enforcement on sensitive actions (OTP verify, password reset, email change)
• During bug bounty or penetration testing of financial or transactional features

Prerequisites

• curl installed
• GNU parallel installed (apt install parallel or brew install parallel)
• Two test accounts on the target (attacker account with a redeemable asset, e.g. a coupon code)

Inputs