Race conditions
If it should happen once, send it twice in one RTT. Coupons, invites, MFA, balances. Two sessions you own. HTTP/2 single-packet makes this cheap.
Playbooks
- Race Conditions (single-packet attack) - Exploit small timing windows where the app checks-then-acts, to double-spend, bypass limits, or over-redeem.
- MFA / 2FA Bypass - MFA that is checked in the UI and not on the API is not MFA. Test skip, brute, race, and backup codes.
- Advanced JavaScript Analysis - Turn shipped JavaScript into a bounded, evidence-led map of client attack paths: collect only in-scope artifacts, recover source where exposed, trace controllable data to real sinks or authorization decisions, then validate the smallest safe chain.
Gadgets
- Race / limit overrun - Coupon once, gift-card drain, extra votes, extra MFA tries, extra password-reset, extra invitations.
- TOCTOU / last-write race - Limit, coupon, MFA, balance, or unique-constraint checks that are check-then-act without a transaction. HTTP/2 single-packet makes this cheap.
Payloads
- MFA / OTP - Skip, tamper, and race probes. Do not brute a production OTP pool past the program's rate-limit rule.
- Second-order canaries - A harmless marker helps trace data that is stored first and processed later by exports, notifications, dashboards, or integrations. Test only accounts and records you control.
- Race / parallel-action probes - Two sessions you own, one unique action, one RTT. Measure leftover extra credit, not a drained victim.
Bypasses
- MFA skip / race / tamper - The UI is not the enforcement point. Hit the session issuer, the mobile API, and the OTP counter.
- Limit and uniqueness races - If it should happen once, send it twice in one RTT. Two sessions you own.
Checklists
- Race / TOCTOU - If it should happen once, send it twice in one RTT.
Workflows
- JavaScript to API authorization - Trace client-side routes, feature flags, and request builders to the APIs they call, then validate server enforcement with controlled roles. A hidden UI is not an authorization boundary.
Questions
Is a double 200 enough?
Show leftover extra credit, two rows, or MFA disabled. Timing jitter needs a few bursts, not one lucky pair.
Idempotency-Key?
Send the same key twice and two different keys. Both behaviours are in scope to document.
This page is the public form of hunt_brief("race") on the MCP connector. Authorized testing only.