Race Condition

This is the playbook for finding TOCTOU bugs in web apps where check and update aren't atomic. It walks you through HTTP/2 single-packet attacks, Turbo Intruder gate patterns, and last-byte sync techniques to hit endpoints with tight parallel bursts. The focus is one-time operations like coupon redemption, balance transfers, and referral claims where duplicate success responses or inconsistent state mean you've broken the locking. Includes practical Turbo Intruder templates with gate releases and a priority matrix for what to fuzz first. If you're testing rate limits, inventory systems, or anything that should only happen once per user, this gives you the transport-layer tricks and application evidence you need to prove the race.

skills.sh installs: 3.8K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill race-condition --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: Race Conditions — Testing & Exploitation Playbook

AI LOAD INSTRUCTION: Treat race conditions as authorization/state integrity issues: non-atomic read-then-write lets multiple requests observe stale state. Prioritize one-time or balance-like operations. Combine parallel transport (HTTP/1.1 last-byte sync, HTTP/2 single-packet, Turbo Intruder gates) with application evidence (duplicate success responses, inconsistent balances, duplicate ledger rows). Authorized testing only. Routing note: for business workflows, coupons, inventory, or one-time rewards, start with this skill and cross-load business-logic-vulnerabilities.