vulns.co
/
mcp by GKData.io

Back to Gadgets

TOCTOU / last-write race

Two parallel requests of a state change that should be unique (apply coupon, redeem invite, enable-then-disable MFA, transfer). The gadget is the missing lock, not the parallelism.

Tags: race, toctou, ato, limit

Typical severity: P2-P3

What it becomes

Limit, coupon, MFA, balance, or unique-constraint checks that are check-then-act without a transaction. HTTP/2 single-packet makes this cheap.

Where to look

  • coupons
  • invite tokens
  • MFA enable/disable
  • balance transfers
  • unique username claims
  • rate-limit counters

Chains

  • Limit overrun: N parallel redeems, one lockout increment.
  • ATO: Race email-change confirm vs session issue, or MFA disable vs login.
  • Integrity: Two transfers both read the same balance.

Notes

  • Two accounts or two sessions you own. Do not race a real coupon on a production storefront if the program forbids it.
  • Burp Turbo Intruder / httpx parallel is enough. Prove with a leftover extra credit, not a drained victim.

Back to Gadgets