pentest-race-conditions

Purpose Exploit applications that fail to handle concurrent requests atomically — enabling double-spend, limit bypass, privilege escalation through parallel requests. Absent from standard WSTG categories but critical in real-world assessments.

| Timing Attacks | Turbo Intruder, race-the-web | Microsecond-synchronized parallel requests | | Async Scripting | Python asyncio/aiohttp, httpx | Custom race condition scripts | | Shell Concurrency | GNU parallel, xargs, curl | Quick parallel request testing | | Proxy Analysis | Burp Suite Repeater | Request replay and timing observation |

| Database Monitoring | pgstatactivity, SHOW PROCESSLIST | Observe lock contention and deadlocks |

並發利用－Web 應用程式中的競爭條件、TOCTOU 漏洞和平行請求濫用。 來源：jd-opensource/joysafeter。