killchain-compendium/Exploits/Web/Race Conditions.md

Race Conditions

Race conditions inside web applications can be tested through flooding a server with HTTP requests.

You can use Burpsuite for this or create a script.

Create a Race Condition through Burpsuite

Send the intercepted request to the Repeater. Create a tab group an insert said request. duplicate the request multiple times through right clicking the tab of the request. Click on the "V" right next to the Send button. Send the request through "Send group in parallel (last byte-sync)", additionally try "Send group in sequence (seperate connections)".