vulns.co
/
mcp by GKData.io

Back to Checklists

Race / TOCTOU

If it should happen once, send it twice in one RTT.

Tags: race, toctou, limit

Checklist

  • Pick a unique action: Coupon, invite, MFA confirm, transfer, claim username, redeem credit.
  • Two sessions you own: Do not race other customers. Parallelize from two cookies or HTTP/2 streams.
  • Single-packet: HTTP/2 Turbo Intruder / last-byte sync so the lock cannot increment between requests.
  • Measure: Both 200? Extra credit remaining? Two rows in the DB? Screenshot plus IDs.
  • Idempotency keys: If the API has Idempotency-Key, send the same key and different keys. Both are tests.
  • Cleanup: Revert coupons, invites, extra credits. Do not leave a production limit broken.

Back to Checklists