17건 · 관련도순
Exploit Time-of-Check to Time-of-Use (TOCTOU) race conditions in web applications and APIs. Use this skill when testing transactional operations (e.g., applying coupons, transferring funds, redeeming rewards, or purchasing items) to bypass business logic and duplicate actions before the server updates its database state.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Web race condition exploitation — TOCTOU, single-packet attack, limit overrun, parallel race testing
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect and exploit race condition vulnerabilities in web applications using Turbo Intruder's single-packet attack technique to bypass rate limits, duplicate transactions, and exploit time-of-check-to-time-of-use flaws.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Reproduce timing and ordering bugs in a CTF sandbox using controlled concurrent requests. Compare normal and racing runs, trace reads and writes, and preserve a minimal sequence that demonstrates duplicate actions or inconsistent state.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Hunting skill for race condition vulnerabilities. Built from 12 public bug bounty reports including modern HTTP/2 single-packet attack cases (James Kettle DEF CON 2023 "Smashing the State Machine"; RyotaK / Flatt Security 10,000-request first-sequence-sync expansion 2024). Covers coupon double-redemption, gift-card double-spend, MFA-OTP-validate race, account-create race, faucet/crypto token double-mint, email-activation race, vote/upvote inflation, password-reset token race, rate-limit bypass via concurrent requests. Use when hunting race conditions, TOCTOU bugs, MFA-bypass-via-timing.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Race condition and TOCTOU testing for web apps. Use when testing one-time operations, concurrent HTTP abuse, rate-limit bypass, Turbo Intruder gates, HTTP/2 single-packet attacks, and CWE-362-style synchronization gaps.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Fix "content disappears after publishing" bugs caused by REST API indexing lag. Use when: (1) User publishes content but it doesn't appear in their feed/profile, (2) REST API returns stale data immediately after write operations, (3) Async indexing backends (ClickHouse, Elasticsearch, etc.) haven't processed new events, (4) Content shows briefly then vanishes on refresh. Applies to any system with separate write path (WebSocket/direct DB) and read path (REST API with async indexing).
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Fix "Null check operator used on a null value" errors when an object is set to null during an async await. Use when: (1) Object reference is nullified while awaiting, (2) Code accesses object with ! after await returns, (3) Cancel/dispose operations run concurrently with async operations on same object. Solution: capture local reference before await.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for race windows, ordering bugs, idempotency failures, lock gaps, concurrent worker drift, and state inconsistencies that produce decisive effects. Use when the user asks to reproduce timing-sensitive bugs, concurrent state corruption, duplicate actions, stale reads, or privilege or balance drift caused by request ordering. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Hunt full Account Takeover (ATO) by chaining lower-severity findings — IDOR-to-email-disclosure, password-reset-token-theft, OAuth-redirect-uri abuse, response-manipulation, cookie scope, CRLF in Set-Cookie, race-condition on signup. Use when the user wants to escalate small findings to ATO or thinks an ATO path exists.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Race condition and TOCTOU testing for web apps. Use when testing one-time operations, concurrent HTTP abuse, rate-limit bypass, Turbo Intruder gates, HTTP/2 single-packet attacks, and CWE-362-style synchronization gaps.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Identify and exploit flaws in the core business rules and logic of web applications. This skill focuses on manipulation of application workflows, pricing, inventory limitations, and multi-step processes. Use this skill when bug hunting or testing e-commerce, banking, or SaaS platforms where standard technical vulnerabilities (e.g., XSS/SQLi) are not present but the application's logic is flawed.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
await 漏れ・floating promise・並行競合など、非同期処理の correctness バグを検出する。並列化の効率提案（SIMPLIFY Efficiency）や配線断点（e2e-wiring）ではなく、「await を忘れて結果・順序・エラー伝播が壊れる」実装バグに限定する
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Expert en concurrence (threads, async/await, mutex, channels, race conditions)
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
You are helping a penetration tester exploit race conditions and TOCTOU
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Race condition (TOCTOU) testing checklist: identifying timing windows, Burp Suite Turbo Intruder, Last-Byte sync technique, rate limit bypass, double-spend attacks, and concurrent request exploitation. Use for web app race condition testing or bug bounty time-of-check-to-time-of-use bugs.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Hunting skill for race condition vulnerabilities. Built from 12 public bug bounty reports including modern HTTP/2 single-packet attack cases (James Kettle DEF CON 2023 'Smashing the State Machine'; RyotaK / Flatt Security 10,000-request first-sequence-sync expansion 2024). Covers coupon double-redemption, gift-card double-spend, MFA-OTP-validate race, account-create race, faucet/crypto token double-mint, email-activation race, vote/upvote inflation, password-reset token race, rate-limit bypass via concurrent requests. Use when hunting race conditions, TOCTOU bugs, MFA-bypass-via-timing.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.