<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: hunting-race-condition-bugs
description: >-
  Discover and exploit race conditions including TOCTOU, double-spend, and limit bypass attacks.
domain: cybersecurity
subdomain: bug-bounty
tags:
  - race-condition
  - concurrency
  - toctou
  - bug-bounty
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1190"]
---

# Hunting Race Condition Bugs

## Overview

Discover and exploit race conditions including TOCTOU, double-spend, and limit bypass attacks.

## Prerequisites

| Requirement | Install |
|---|---|
| Turbo Intruder | Burp extension |
| Python 3.10+ | With asyncio |
| Burp Suite | Request capture |

## Key Concepts

Race conditions exploit timing windows in concurrent requests.
Targets: coupon redemption, transfers, vote counting.
HTTP/2 single-packet attacks improve reliability.

## Quick Reference

```bash
node agent.js race --url https://target.com/redeem --threads 100
node agent.js single-packet --url https://target.com/transfer --count 20
node agent.js limit-bypass --url https://target.com/vote --max-concurrent 50
node agent.js analyze --url https://target.com/redeem --samples 100
```

## Workflow

1. Identify state-changing ops
2. Determine race windows
3. Send concurrent requests
4. HTTP/2 single-packet
5. Verify multiple successes
6. Measure window
7. Document impact

## Verification

- Verify simultaneous requests
- Confirm reproducible
- Validate impact
- Check single-packet
- Verify financial quantification

## References

- OWASP Testing Guide — https://owasp.org/www-project-web-security-testing-guide/
- MITRE ATT&CK — https://attack.mitre.org/
- NIST SP 800-53 — https://csf.tools/reference/nist-sp-800-53/
