About pentest-race-conditions
A security skill for authorized penetration testers investigating race conditions caused by non-atomic concurrent requests. It covers synchronized requests, cross-endpoint TOCTOU and session-level tests, with a workflow for documenting impact and reproduction steps.
Key features
- 01Identify race-prone operations
- 02Test concurrent and synchronized requests
- 03Check cross-endpoint TOCTOU
- 04Test session and database races
- 05Document impact and reproduction steps
Use cases
- 01Check for duplicate coupon redemption or transactions
- 02Test whether parallel requests bypass usage limits
- 03Probe races between balance checks and debits
- 04Record reproduction conditions for concurrency flaws
Install
Copy the command and run it in a terminal.
$
npx skills add https:/After installing, type/pentest-race-conditionsin Claude Code to confirm it loaded.
Bundled filesreferences/tools.mdreferences/workflows.md
Details
From the project READMEPentest Race Conditions
Purpose
Exploit applications that fail to handle concurrent requests atomically — enabling double-spend, limit bypass, privilege escalation through parallel requests. Absent from standard WSTG categories but critical in real-world assessments.
Prerequisites
Authorization Requirements
- Written authorization with explicit scope for concurrency testing
- Test accounts with balances, quotas, or limited-use resources
- Rollback plan for financial or state-mutating operations
- Rate limit awareness — confirm acceptable burst volume with target owner
Environment Setup
- Burp Suite Professional with Turbo Intruder extension
- Python 3.x with asyncio/aiohttp for parallel request scripting
- GNU parallel or xargs for shell-based concurrency
- Multiple authenticated sessions (separate cookies/tokens)
Core Workflow
- Target Identification: Identify race-prone operations — balance transfers, coupon redemption, inventory purchase, vote/like systems, token generation, file operations.
- Single-Endpoint Races: Send N identical requests simultaneously to bypass "one per user" limits, duplicate transactions (limit-overrun).
- Multi-Endpoint TOCTOU: Exploit time gap between check and use — validate coupon then apply coupon, check balance then debit.
- Session-Level Races: Parallel password change + session refresh, simultaneous role change + action execution.
- Database-Level Races: Exploit missing row-level locks, test optimistic vs pessimistic concurrency, trigger deadlocks.
- Timing Synchronization: Use single-packet attack technique (Turbo Intruder) to synchronize requests within microseconds.
- Impact Documentation: Document financial/operational impact with precise reproduction steps and timing requirements.
Tool Categories
| Category | Tools | Purpose |
|---|---|---|
| Timing Attacks | Turbo Intruder, race-the-web | Microsecond-synchronized parallel requests |
| Async Scripting | Python asyncio/aiohttp, httpx | Custom race condition scripts |
| Shell Concurrency | GNU parallel, xargs, curl | Quick parallel request testing |
| Proxy Analysis | Burp Suite Repeater | Request replay and timing observation |
| Database Monitoring | pg_stat_activity, SHOW PROCESSLIST | Observe lock contention and deadlocks |
References
references/tools.md- Tool function signatures and parametersreferences/workflows.md- Attack pattern definitions and test vectors
Comments
Markdown supported