Individual skill
race-condition
Race condition / TOCTOU exploitation — concurrent and parallel-request attacks against web applications that check then act, write session state before validating it, or perform slow operations that widen the race window. Covers single-endpoint races (double-spend, coupon abuse, balance overflow) and multi-endpoint state-leak races where a session write on one endpoint leaks privilege into another endpoint mid-request.
packages/decepticon/decepticon/skills/standard/exploit/web/race-condition/SKILL.md
Source commit cc6044561ff32188dc0aa899bcc7d3666ffcfd1c
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- Yes
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Network or broad shell
- Last checked
- Nov 2, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 6,561
- Repository last updated
- Nov 7, 2026
- License
- Apache-2.0
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- agent Repository topic
- ai Repository topic
- cybersecurity Repository topic
- hacking Repository topic
- langchain Repository topic
- langgraph Repository topic
- llm Repository topic
- generative-ai Repository topic
- pentesting Repository topic
- pentest Repository topic
- operations Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
Read excerpt
# Race Conditions (TOCTOU)
Exploits applications that check authorization or state at one moment and act on it at another, or that write session state before validating it. The race window is the time between check and act — wider windows (slow ops like bcrypt/Argon2, DB round-trips, network calls) make the race trivially winnable.
## Recognition Signals
Trigger this skill when ANY of the following are present:
- **Slow auth path**: bcrypt/Argon2/PBKDF2 in login (>50ms login latency on wrong password). The hash compute widens any race window touching the same session row.
- **`session[k] = form[k]` BEFORE validation**: e.g. login writes `session["user"] = posted_username` before checking the password — the session row carries attacker-chosen state during the bcrypt sleep.
- **Check-then-act money flows**: balance/quota/coupon/transfer endpoints that do `if x.balance >= n: x.balance -= n` without a single atomic UPDATE-with-WHERE-balance>=n.
- **Idempotency-key-less POSTs** to mutating endpoints — same payload N times in parallel produces N writes.
- **Challenge tag** includes `race_condition`, `toctou`, `concurrent`, `last-write-wins`, or `double-spend`. (Note: `smuggling_desync` is a parser-disagreement attack, NOT a race — route to `/skills/standard/exploit/web/smuggling/SKILL.md`.)
- **Session-coupled endpoints**: a POST that mutates session, AND a GET that trusts that session, both reachable concurrently.