Skip to content
Hugin capabilities

How to test for race conditions in web apps

A race condition is only exploitable if your requests land inside the same tiny window. Sending them one after another rarely works. This is how to collapse the window and turn "unexploitable" check-then-act logic into a proven finding.

The method

  1. 1

    Find check-then-act logic

    Look for endpoints that check a condition and then act on it: redeem a coupon, withdraw a balance, apply a discount, join a group, confirm an invite. If the check and the act are separate, there is likely a window.

  2. 2

    Send the requests truly in parallel

    Sequential requests almost always arrive sequentially. Use HTTP/2 multiplexing or a single-packet attack so every request is in flight at once and the last bytes land together.

  3. 3

    Watch state, not status codes

    A race often returns the same 200 on every request while the underlying state is corrupted — two withdrawals, two coupons, two joins. Assert on the resulting state, not the response.

  4. 4

    Test rate limits as races

    Rate limiting is check-then-act too. Fire a burst inside one window and see whether more requests succeed than the limit allows. The bypass is a finding on its own.

  5. 5

    Confirm the window is the cause

    Repeat with sequential requests to show they never succeed, then parallel to show they do. That contrast is what separates a real race from a flaky business-logic bug.

Do it in Hugin

Hugin has a dedicated race engine using the single-packet attack for last-byte synchronisation and parallel fan-out, with response diffing to spot the corrupted state — so you are not hand-rolling timing scripts against every target.

Race-condition engine capability

Frequently asked

Why do my race requests never work?

They are usually arriving sequentially. Network and TLS overhead spreads them out. HTTP/2 multiplexing helps; a single-packet attack that sends all but the last byte, then releases the last byte at once, closes the gap.

How many requests do I need for a race?

Often two are enough to prove the window. Send them in parallel, repeat a handful of times for confidence, and confirm the state change. Do not flood the target.

Put the method into a tool

Hugin is free to download, no account.

Download Hugin

More guides