payloads-race-condition

Original：🇺🇸 English

Translated

Race conditions may occur when a process is critically or unexpectedly dependent on the sequence or timings of other events. In a web application environment, where multiple requests can be processed at a given time, developers may leave concurrency to be handled by the framework, server, or programming language. - - - - a Burp Suite extension for sending large numbers of HTTP requests and...

2installs

Sourcesmartworldarafath/rea_skill

Added on2026-11-09

NPX Install

npx skill4agent add smartworldarafath/rea_skill payloads-race-condition

SKILL.md Content

View Translation Comparison →

Race Condition Payloads

Source: PayloadsAllTheThings/Race Condition Category:
payloads-web
| Skill ID:
payloads-race-condition

Overview

Race condition attack payloads and timing attack scripts for state manipulation exploits.

This skill integrates the full PayloadsAllTheThings (PATT) payload library for the Race Condition Payloads domain into the REA_Skill framework. Use it during authorized penetration testing, bug bounty research, security audits, and CTF challenges.

Workflow

1. Recon & Identification

Identify the target technology stack and injection points
Enumerate endpoints, parameters, and input vectors
Determine applicable payload categories from the reference below

2. Payload Selection

Browse the PATT payload library for the attack class
Select encoding-appropriate payloads for the target environment
Consider WAF bypass variants and obfuscation techniques

3. Exploitation (Authorized Only)

Test payloads in order: passive → active → escalation
Document every payload tested and its response
Capture PoC evidence (screenshots, HTTP logs, curl output)

4. Verification & Reporting

Confirm the vulnerability with a clean minimal PoC
Map findings to CVE/CWE where applicable
Report with remediation recommendations and code fixes

Full PATT Reference

Race Condition

Race conditions may occur when a process is critically or unexpectedly dependent on the sequence or timings of other events. In a web application environment, where multiple requests can be processed at a given time, developers may leave concurrency to be handled by the framework, server, or programming language.

Summary

Tools
Methodology
- Limit-overrun
- Rate-limit Bypass
Techniques
- HTTP/1.1 Last-byte Synchronization
- HTTP/2 Single-packet Attack
Turbo Intruder
- Example 1
- Example 2
Labs
References

Tools

PortSwigger/turbo-intruder - a Burp Suite extension for sending large numbers of HTTP requests and analyzing the results.
JavanXD/Raceocat - Make exploiting race conditions in web applications highly efficient and ease-of-use.
nxenon/h2spacex - HTTP/2 Single Packet Attack low Level Library / Tool based on Scapy‌ + Exploit Timing Attacks

Methodology

Limit-overrun

Limit-overrun refers to a scenario where multiple threads or processes compete to update or access a shared resource, resulting in the resource exceeding its intended limits.

Examples: Overdrawing limit, multiple voting, multiple spending of a giftcard.

Rate-limit Bypass

Rate-limit bypass occurs when an attacker exploits the lack of proper synchronization in rate-limiting mechanisms to exceed intended request limits. Rate-limiting is designed to control the frequency of actions (e.g., API requests, login attempts), but race conditions can allow attackers to bypass these restrictions.

Examples: Bypassing anti-bruteforce mechanism and 2FA.

Instagram Password Reset Mechanism Race Condition - Laxman Muthiyah

Techniques

HTTP/1.1 Last-byte Synchronization

Send every requests except the last byte, then "release" each request by sending the last byte.

Execute a last-byte synchronization using Turbo Intruder

py

engine.queue(request, gate='race1')
engine.queue(request, gate='race1')
engine.openGate('race1')

Examples:

Cracking reCAPTCHA, Turbo Intruder style - James Kettle

HTTP/2 Single-packet Attack

In HTTP/2 you can send multiple HTTP requests concurrently over a single connection. In the single-packet attack around ~20/30 requests will be sent and they will arrive at the same time on the server. Using a single request remove the network jitter.

PortSwigger/turbo-intruder/race-single-packet-attack.py
Burp Suite
- Send a request to Repeater
- Duplicate the request 20 times (CTRL+R)
- Create a new group and add all the requests
- Send group in parallel (single-packet attack)

Examples:

CVE-2022-4037 - Discovering a race condition vulnerability in Gitlab with the single-packet attack - James Kettle

Turbo Intruder

Example 1

Send request to turbo intruder

Use this python code as a payload of the turbo intruder

python

def queueRequests(target, wordlists):
    engine = RequestEngine(endpoint=target.endpoint,
                        concurrentConnections=30,
                        requestsPerConnection=30,
                        pipeline=False
                        )

for i in range(30):
    engine.queue(target.req, i)
        engine.queue(target.req, target.baseInput, gate='race1')


    engine.start(timeout=5)
engine.openGate('race1')

    engine.complete(timeout=60)


def handleResponse(req, interesting):
    table.add(req)

Now set the external HTTP header x-request: %s - :warning: This is needed by the turbo intruder
Click "Attack"

Example 2

This following template can use when use have to send race condition of request2 immediately after send a request1 when the window may only be a few milliseconds.