Race Condition labs

Race Condition (TOCTOU)

What is Race Condition?

Race Conditions occur when the application doesn't correctly handle concurrent operations. They let you duplicate transactions, bypass limits, apply coupons multiple times or exploit the time window between check and use (TOCTOU).

Why practice Race Condition?

Race conditions are hard to detect with automated scanners, which means less competition. Bounties tend to be high because they directly hit business logic (duplicate payments, infinite coupons, rate-limiting bypass, free-trial leverage).

What will you learn with the Race Condition labs?

You'll learn to identify susceptible operations (balance decrement, coupon claims, votes), use Turbo Intruder and Burp's single-packet attack (2022.6+), calculate TOCTOU windows via cache-warming requests, and report with visual evidence of the inconsistent state.

Types of Race Condition we cover

  • Classic TOCTOU

    Time-Of-Check vs Time-Of-Use: the check (balance > 0) and the use (balance--) aren't atomic. Two parallel requests decrement twice.

  • Limit overrun

    Single-use coupons, per-user votes, bonus claims. Sending N simultaneous requests, all pass the check before the first one writes.

  • Single-packet attack

    James Kettle's technique (PortSwigger): pack 20-30 requests into a single TCP/HTTP2 packet so they hit the server within <1ms of each other.

How do you find and exploit Race Condition?

A practical playbook — from recon to proof of concept.

  1. 1

    Identify a limited-state operation

    Look for actions that should happen only once or have a limit: redeem a coupon, withdraw balance, apply bonus, vote, redeem a gift card.

    POST /api/coupon/redeem   {"code":"WELCOME10"}   (should be single-use)
  2. 2

    Capture and duplicate the request

    Send the same request many times in parallel to collide between the check and the write. In Burp, group them into a parallel group.

    Burp → Send group in parallel (single-packet attack)
  3. 3

    Launch the single-packet attack

    With Turbo Intruder or Burp 2022.6+, pack 20-30 requests into a single HTTP/2 packet so they arrive within <1ms of each other and win the race.

    engine=Engine.BURP2, concurrentConnections=1; 30x engine.queue(request)
  4. 4

    Verify the inconsistent state

    Check the effect: coupon applied N times, negative balance, several withdrawals. Capture evidence of the broken state.

    Balance before: 100 · 5 withdrawals of 100 processed · Balance: -400
  5. 5

    Report with economic impact

    Quantify it: how many times it duplicated, the monetary value and the window. That raises severity and bounty.

    30/30 redemptions accepted of a single-use coupon → reproducible fraud

Learn the theory

Academy: Race Conditions

Frequently asked questions

What is a Race Condition?

It's a flaw that happens when two or more concurrent requests manipulate the same resource and the app doesn't guarantee atomicity. The window between the check and the use lets several requests pass the control before any of them writes the new state.

How is a Race Condition exploited?

You send multiple identical requests in parallel so they collide in that window. With the single-packet attack (Burp/Turbo Intruder) dozens land within less than 1ms of each other, duplicating coupon redemptions, balance withdrawals or votes.

How do you find Race Conditions in bug bounty?

Look for operations that should be single-use or limited (coupons, gift cards, withdrawals, free trials, votes) and resend them as a parallel group. If the effect multiplies, there's a race. Scanners don't detect them, so there's little competition.

How do you prevent a Race Condition?

Use atomic operations and database transactions, pessimistic/optimistic locks (SELECT ... FOR UPDATE, versioning), uniqueness constraints and idempotency keys on state-changing requests.

What is the single-packet attack?

It's a James Kettle (PortSwigger) technique that encapsulates 20-30 requests in a single TCP packet using HTTP/2 to neutralize network jitter, making them hit the server almost simultaneously and maximizing the odds of winning the race.

hunters training
650

hunters training

labs from real reports
50

labs from real reports

completions
380

completions

in bounties practiced
$200,000

in bounties practiced

40 flags captured this week·Real reports from HackerOne · Bugcrowd · Intigriti·No commitment·Free Academy
BBLabs · bug bounty training

Practice Race Condition in real labs

Every Race Condition lab replicates a real bug bounty report that got paid. Create your free account, start with the Academy and move to the labs whenever you want.

No card · free Academy · cancel anytime