Advanced Offensive Security
Race Conditions (TOCTOU) — Concept + Live Lab
Exploit the gap between a check and its use with concurrent requests.
Open the interactive lesson & lab →
A race condition happens when the outcome depends on timing. The classic web version is Time-Of-Check-To-Time-Of-Use (TOCTOU): the app checks a condition (enough balance, coupon unused) and then acts on it — but between those two steps, other concurrent requests slip through the same check.
Where they hide
- Redeeming a coupon / gift card more than once.
- Withdrawing or transferring more money than you have.
- Bypassing a 'one per account' limit (votes, purchases, signups).
- Applying a discount multiple times.
The exploit: send many identical requests in parallel (Burp Turbo Intruder, or just fire them simultaneously) so several pass the check before any of them commit the update.