TOCTOU / last-write race
Two parallel requests of a state change that should be unique (apply coupon, redeem invite, enable-then-disable MFA, transfer). The gadget is the missing lock, not the parallelism.
Tags: race, toctou, ato, limit
Typical severity: P2-P3
What it becomes
Limit, coupon, MFA, balance, or unique-constraint checks that are check-then-act without a transaction. HTTP/2 single-packet makes this cheap.
Where to look
couponsinvite tokensMFA enable/disablebalance transfersunique username claimsrate-limit counters
Chains
- Limit overrun: N parallel redeems, one lockout increment.
- ATO: Race email-change confirm vs session issue, or MFA disable vs login.
- Integrity: Two transfers both read the same balance.
Notes
- Two accounts or two sessions you own. Do not race a real coupon on a production storefront if the program forbids it.
- Burp Turbo Intruder / httpx parallel is enough. Prove with a leftover extra credit, not a drained victim.