pentest-race-conditions

Purpose Exploit applications that fail to handle concurrent requests atomically — enabling double-spend, limit bypass, privilege escalation through parallel requests. Absent from standard WSTG categories but critical in real-world assessments.

| Timing Attacks | Turbo Intruder, race-the-web | Microsecond-synchronized parallel requests | | Async Scripting | Python asyncio/aiohttp, httpx | Custom race condition scripts | | Shell Concurrency | GNU parallel, xargs, curl | Quick parallel request testing | | Proxy Analysis | Burp Suite Repeater | Request replay and timing observation |

| Database Monitoring | pgstatactivity, SHOW PROCESSLIST | Observe lock contention and deadlocks |

并发利用——Web 应用程序中的竞争条件、TOCTOU 漏洞和并行请求滥用。 来源：jd-opensource/joysafeter。