Race Conditions
Check List
Cheat Sheet
Methodology (Black Box)
Race Condition / Concurrency Testing
Create a free account on target
Navigate to the section offering “Claim Free <resource>” or “Purchase <item>”
Trigger the action and observe the redirect or request to
https:///api//start?item=<resource_name>
Capture the final transaction request
POST /api/v1/<api-endpoint>Duplicate this request 5–15 times
Modify a minor field like parameter in each duplicate
Send all modified requests simultaneously (parallel execution)
Check if multiple successful transactions occur for the same action
Quota‑Limit Bypass via Concurrent Folder‑Creation Requests
Navigate to the Knowledge section on <platform> and select a specific <knowledge_space> (e.g., project or team space)
Create folders until you reach the configured limit <max_folder_count> (e.g., 10 folders)
Attempt to create one additional folder and confirm the server returns a “limit reached” error
Delete one folder so the total count becomes <max_folder_count - 1>
Immediately after deletion, send N parallel folder-creation requests (e.g., 2–20) to POST <folder_creation_endpoint> with payloads containing <folder_name> (use distinct names for each request)
Verify whether the total number of folders for <knowledge_space> exceeds <max_folder_count>
Non‑Idempotent Request Replay
Log in to Account Sign in to the platform using valid credentials
Purchase a Gift Card Buy a gift card on the platform
Redeem Gift Card Navigate to https://sandbox.reverb.com//redeem and initiate the gift card redemption process
Intercept Redemption Request Capture the POST request to /fi/redeem containing utf8, authenticity_token, token, and commit parameters using Burp Suite Pro
Send Request to Turbo Intruder Transfer the intercepted request to Turbo Intruder
Set External HTTP Header Configure the external HTTP header x-request: %s in Turbo Intruder
Execute the Attack Run the attack in Turbo Intruder and observe multiple 200 OK responses
Verify Increased Balance Check the account balance to confirm that the gift card value has been redeemed multiple times
Race Condition (Concurrent Redemption / Double-spend)
Log in to Account Sign in to the platform using valid credentials
Purchase a Gift Card Buy a gift card on the platform
Redeem Gift Card Navigate to https://sandbox.reverb.com//redeem and initiate the gift card redemption process
Intercept Redemption Request Capture the POST request to /fi/redeem containing utf8, authenticity_token, token, and commit parameters using Burp Suite Pro
Send Request to Turbo Intruder Transfer the intercepted request to Turbo Intruder and apply the provided Python script with 30 concurrent connections
Set External HTTP Header Configure the external HTTP header x-request: %s in Turbo Intruder
Execute the Attack Run the attack in Turbo Intruder and observe multiple 200 OK responses
Verify Increased Balance Check the account balance to confirm that the gift card value has been redeemed multiple times
Authentication Token Issuance Race
Prepare a list of login payloads (include incorrect passwords and the correct password)
Choose concurrency level (start with 20–50 parallel requests)
Capture a valid login POST request and send it to Burp/Turbo Intruder or a parallel-request tool
Configure the tool to send your prepared payloads simultaneously
Launch the parallel attack
Inspect responses and identify any response that returns a JWT
Decode the JWT and extract the authCode (or equivalent MFA state)
Construct a login/verify request using the captured JWT and a random 6-digit OTP
Send the verify request and check for successful authentication (session or 200 OK)
Repeat attempts as needed (race is probabilistic) and log successful JWTs/responses
Email‑verification race
Create a new account (email remains unverified)
Find and capture the email verification POST request (the one sent when clicking the verification link)
Find and capture the change-email request (the POST that updates the account email)
Prepare two requests: (A) change-email → set target email (e.g. victim@domain.com), (B) verify-email → same valid verification token
Use a parallel-request tool (Turbo Intruder / Burp / parallel curl) to send A and B simultaneously (high concurrency / single-packet timing)
Inspect responses for success; check the account’s email status
Confirm by performing an action that requires a verified email (invite, access feature, etc)
Repeat to verify reproducibility and log any successful attempts
White Box
Last updated