Race Condition labs
Race Condition (TOCTOU)
What is Race Condition?
Race Conditions occur when the application doesn't correctly handle concurrent operations. They let you duplicate transactions, bypass limits, apply coupons multiple times or exploit the time window between check and use (TOCTOU).
Why practice Race Condition?
Race conditions are hard to detect with automated scanners, which means less competition. Bounties tend to be high because they directly hit business logic (duplicate payments, infinite coupons, rate-limiting bypass, free-trial leverage).
What will you learn with the Race Condition labs?
You'll learn to identify susceptible operations (balance decrement, coupon claims, votes), use Turbo Intruder and Burp's single-packet attack (2022.6+), calculate TOCTOU windows via cache-warming requests, and report with visual evidence of the inconsistent state.
Types of Race Condition we cover
- Classic TOCTOU
Time-Of-Check vs Time-Of-Use: the check (balance > 0) and the use (balance--) aren't atomic. Two parallel requests decrement twice.
- Limit overrun
Single-use coupons, per-user votes, bonus claims. Sending N simultaneous requests, all pass the check before the first one writes.
- Single-packet attack
James Kettle's technique (PortSwigger): pack 20-30 requests into a single TCP/HTTP2 packet so they hit the server within <1ms of each other.
How do you find and exploit Race Condition?
A practical playbook — from recon to proof of concept.
- 1
Identify a limited-state operation
Look for actions that should happen only once or have a limit: redeem a coupon, withdraw balance, apply bonus, vote, redeem a gift card.
POST /api/coupon/redeem {"code":"WELCOME10"} (should be single-use) - 2
Capture and duplicate the request
Send the same request many times in parallel to collide between the check and the write. In Burp, group them into a parallel group.
Burp → Send group in parallel (single-packet attack) - 3
Launch the single-packet attack
With Turbo Intruder or Burp 2022.6+, pack 20-30 requests into a single HTTP/2 packet so they arrive within <1ms of each other and win the race.
engine=Engine.BURP2, concurrentConnections=1; 30x engine.queue(request) - 4
Verify the inconsistent state
Check the effect: coupon applied N times, negative balance, several withdrawals. Capture evidence of the broken state.
Balance before: 100 · 5 withdrawals of 100 processed · Balance: -400 - 5
Report with economic impact
Quantify it: how many times it duplicated, the monetary value and the window. That raises severity and bounty.
30/30 redemptions accepted of a single-use coupon → reproducible fraud
Learn the theory
Academy: Race Conditions
Loading labs...
View in full catalog →Frequently asked questions
What is a Race Condition?
It's a flaw that happens when two or more concurrent requests manipulate the same resource and the app doesn't guarantee atomicity. The window between the check and the use lets several requests pass the control before any of them writes the new state.
How is a Race Condition exploited?
You send multiple identical requests in parallel so they collide in that window. With the single-packet attack (Burp/Turbo Intruder) dozens land within less than 1ms of each other, duplicating coupon redemptions, balance withdrawals or votes.
How do you find Race Conditions in bug bounty?
Look for operations that should be single-use or limited (coupons, gift cards, withdrawals, free trials, votes) and resend them as a parallel group. If the effect multiplies, there's a race. Scanners don't detect them, so there's little competition.
How do you prevent a Race Condition?
Use atomic operations and database transactions, pessimistic/optimistic locks (SELECT ... FOR UPDATE, versioning), uniqueness constraints and idempotency keys on state-changing requests.
What is the single-packet attack?
It's a James Kettle (PortSwigger) technique that encapsulates 20-30 requests in a single TCP packet using HTTP/2 to neutralize network jitter, making them hit the server almost simultaneously and maximizing the odds of winning the race.
Other related categories
- hunters training
- 650
- labs from real reports
- 50
- completions
- 380
- in bounties practiced
- $200,000
hunters training
labs from real reports
completions
in bounties practiced
Practice Race Condition in real labs
Every Race Condition lab replicates a real bug bounty report that got paid. Create your free account, start with the Academy and move to the labs whenever you want.
No card · free Academy · cancel anytime