Race Condition

This is the playbook for finding TOCTOU bugs in web apps where check and update aren't atomic. It walks you through HTTP/2 single-packet attacks, Turbo Intruder gate patterns, and last-byte sync techniques to hit endpoints with tight parallel bursts. The focus is one-time operations like coupon redemption, balance transfers, and referral claims where duplicate success responses or inconsistent state mean you've broken the locking. Includes practical Turbo Intruder templates with gate releases and a priority matrix for what to fuzz first. If you're testing rate limits, inventory systems, or anything that should only happen once per user, this gives you the transport-layer tricks and application evidence you need to prove the race.