jd-opensource/pentest-race-conditions

Pentest Race Conditions

Purpose

Exploit applications that fail to handle concurrent requests atomically — enabling double-spend, limit bypass, privilege escalation through parallel requests. Absent from standard WSTG categories but critical in real-world assessments.

Prerequisites

Authorization Requirements

• Written authorization with explicit scope for concurrency testing
• Test accounts with balances, quotas, or limited-use resources
• Rollback plan for financial or state-mutating operations
• Rate limit awareness — confirm acceptable burst volume with target owner

Environment Setup

• Burp Suite Professional with Turbo Intruder extension
• Python 3.x with asyncio/aiohttp for parallel request scripting
• GNU parallel or xargs for shell-based concurrency
• Multiple authenticated sessions (separate cookies/tokens)

Core Workflow

1. Target Identification: Identify race-prone operations — balance transfers, coupon redemption, inventory purchase, vote/like systems, token generation, file operations.
2. Single-Endpoint Races: Send N identical requests simultaneously to bypass "one per user" limits, duplicate transactions (limit-overrun).
3. Multi-Endpoint TOCTOU: Exploit time gap between check and use — validate coupon then apply coupon, check balance then debit.
4. Session-Level Races: Parallel password change + session refresh, simultaneous role change + action execution.
5. Database-Level Races: Exploit missing row-level locks, test optimistic vs pessimistic concurrency, trigger deadlocks.
6. Timing Synchronization: Use single-packet attack technique (Turbo Intruder) to synchronize requests within microseconds.
7. Impact Documentation: Document financial/operational impact with precise reproduction steps and timing requirements.

Tool Categories

| Category | Tools | Purpose | |----------|-------|---------| | Timing Attacks | Turbo Intruder, race-the-web | Microsecond-synchronized parallel requests | | Async Scripting | Python asyncio/aiohttp, httpx | Custom race condition scripts | | Shell Concurrency | GNU parallel, xargs, curl | Quick parallel request testing | | Proxy Analysis | Burp Suite Repeater | Request replay and timing observation | | Database Monitoring | pg_stat_activity, SHOW PROCESSLIST | Observe lock contention and deadlocks |

References

• references/tools.md - Tool function signatures and parameters
• references/workflows.md - Attack pattern definitions and test vectors