Race Condition Lab
A one-time coupon, redeemed with a check-then-act flaw. Fire requests fast enough and redeem it far more than once.
A one-time coupon guarded by a check-then-act flaw. Fire requests fast enough and several pass the check before any of them writes the result — so one coupon redeems many times.
How to use it
- Redeem the coupon normally.
- Fire concurrent requests into the gap between check and act.
- Redeem more times than should be possible.
What to take away
The window is between check and write
Every request reads "unused" before the first write lands. Both operations must be atomic, or the check means nothing.
Database transactions or locks are the fix
A conditional update that both checks and writes in one statement, or an explicit lock. Application-level checks around separate reads and writes will always have this gap.
Frequently asked questions
What is a TOCTOU bug?
Time-of-check to time-of-use — the general name for this class. State changes between validating something and acting on it, so the validation no longer describes reality.
Where do race conditions show up in the real world?
Coupon and voucher redemption, account balance transfers, rate limits, invite codes, and anywhere a "one time only" rule is enforced by reading then writing.
Where this fits in the course
This security lab pairs with Path 15 — Bug Bounty — see all 26 learning paths.
It runs entirely in your browser: nothing is uploaded, no account is needed, and it is free.
Related
- Rate-Limit Bypass Simulator — A login endpoint that blocks you after 3 bad guesses — but trusts a header you control to decide who "you" are.
- SQL Injection Sandbox — A fake login backed by a simulated database. Watch your input become SQL, then bypass the login with a classic injection.
- Timing Attack Visualizer — See exactly why a naive string comparison leaks how many leading characters were correct — and why constant-time comparison fixes it.
- BOLA/BFLA Playground — A fake employee-directory API. Read a record that isn't yours, then call an admin-only action with no admin role at all.