domains / families / security / hunt-race-condition

hunt-race-condition

combined

Hunting skill for race condition vulnerabilities. Hunting skill for race condition vulnerabilities. Built from 12 public bug bounty reports including modern HTTP/2 single-packet attack cases (James Kettle DEF CON 2023 "Smashing the State Machine"; RyotaK / Flatt Security 10,000-request first-sequence-sync expansion 2024). Covers coupon double-redemption, gift-card double-spend, MFA-OTP-validate race, account-create race, faucet/crypto token double-mint, email-activation race, vote/upvote inflation, password-reset token race, rate-limit bypass via concurrent requests. Use when hunting race conditions, TOCTOU bugs, MFA-bypass-via-timing.

When to use

• You have explicit, written authorization to assess the target in scope, and the task matches this skill's vulnerability class or technique within a bug-bounty or penetration-test engagement.
• You need the recon, exploitation, or validation workflow described below — executed strictly inside the approved scope.

When not to use

• Authorized scope only: the confirmation gate above is mandatory before any probing, exploitation, or credential-access command.
• Docs-only import: upstream helper scripts, commands, engine, and research assets are not bundled; reinstall tooling from the source repo when needed.
• Validate every finding (see `triage-validation`) before reporting; report via `report-writing`. Prefer a sandbox, disposable VM, or controlled lab.

Skill page

Conflict

The two copies share the same core methodology, target list, and attack-surface signals, but each contains material steps the other lacks. The uphiago copy provides a detailed 10-step methodology including response analysis, exploitability window testing, and specific Turbo Intruder/curl payload examples. The sickn33 copy adds a mandatory authorization gate, a distinct 'Different-requests race' primitive (partial construction/TOCTOU) with a specific email-verification bypass example, and explicit source attribution. Crowning one would hide the other's unique procedural constraints and attack patterns.