Race conditions
If it should happen once, send it twice in one RTT. Coupons, invites, MFA, balances. Two sessions you own. HTTP/2 single-packet makes this cheap.
Skill
No skill is linked for this class yet. Start with the playbook on this page.
Practice the class in the browser: PortSwigger Web Security Academy. The lab is theirs. This page is the stop condition and the disclosures.
Checklists
- Race / TOCTOU - If it should happen once, send it twice in one RTT.
Disclosures
- Parallel requests passed a verification limit - Race condition
Playbooks
- Race Conditions (single-packet attack) - Exploit small timing windows where the app checks-then-acts, to double-spend, bypass limits, or over-redeem.
Payloads
- Race / parallel-action probes - Two sessions you own, one unique action, one RTT. Measure leftover extra credit, not a drained victim.
Bypasses
- Limit and uniqueness races - If it should happen once, send it twice in one RTT. Two sessions you own.
Questions
Is a double 200 enough?
Show leftover extra credit, two rows, or MFA disabled. Timing jitter needs a few bursts, not one lucky pair.
Idempotency-Key?
Send the same key twice and two different keys. Both behaviours are in scope to document.
This page is the linked pack hunt_brief("race") returns on the MCP connector. Authorized testing only.