wildhunter logo
The arsenal

Payloads.

Pick a vulnerability class, learn how to hunt it step by step, grab the payloads that actually work. Curated from PayloadsAllTheThings — the full section is linked under every class.

SQL InjectionXSSSSRFCommand InjectionSSTIFile Inclusion (LFI)Path TraversalInsecure DeserializationNoSQL InjectionGraphQLJWTCORSRequest SmugglingOpen RedirectFile UploadIDOROAuthAccount TakeoverRace ConditionCRLF InjectionCSRFLDAP InjectionXXEWeb Cache Deception

Race Condition

Sending multiple requests at the same instant to beat a check-then-act window — single-use coupons, transfers, and limits all break. If the server validates then acts in separate steps, parallel requests slip between them.

Severity guide

High when money/limits are beaten (double redemption, negative balance); medium for vote/limit abuse; the single-packet proof is what makes triage believe it.

Where to look

entry points to test first

01

Coupons, credits & gift cards

Redemption, transfer, top-up — the classic targets where double-spend pays.

02

Rate-limited actions

Password reset, OTP verification, votes, withdrawals — limits enforced before the action completes.

03

Profile/email updates

The email-change race: last-write-wins binds an account to the attacker's email.

04

Follow/like/claim buttons

One-per-user constraints enforced with check-then-insert.

05

Multi-step workflows

Payment→fulfillment, approval→execution — states that can be double-triggered mid-transition.

How to hunt it

in order, start to finish

  1. Find rate-limited or single-use actions

    Coupon redemption, gift-card transfer, vote/like limits, password-reset token usage — anywhere the server checks then acts.

  2. Fire parallel requests

    Turbo Intruder with a single-packet gate — N identical requests released simultaneously beat the check together.

  3. Watch for last-write-wins

    Email/profile updates racing can bind a victim's account to your email — the classic 'new email' race.

  4. Prove the win

    Two redemptions of one coupon, or one token used twice — show the server state that shouldn't exist.

  5. Try the session-swap variant

    Mix two different sessions' requests in one packet — multi-session races beat per-session locks too.

Filter & validation bypasses

when your first tries get blocked
  • 01Per-session locks? Mix sessions in one packet — global locks are the only real defense.
  • 02Single-packet blocked? Distributed across connections/IPs still wins on slower check-then-act gaps.
  • 03State machine guards? Look at edge transitions — cancel-during-processing and double-submit at boundaries.
  • 04Randomized delays? Retry — races are probabilistic; 20 attempts is normal.

Impact ladder

what makes it payable
  1. 01Double-spend — coupons, balances, gift cards redeemed twice.
  2. 02Limit bypass — rate limits, withdrawals, and one-per-user constraints beaten.
  3. 03Account binding — email-change races pre-ATO an account.
  4. 04Data corruption — duplicated/contradictory server state from mid-transition writes.

Payloads

2 · from PayloadsAllTheThings
engine.queue(request, gate='race1')

Turbo Intruder — queue N requests without sending.

engine.openGate('race1')

Release all queued requests in a single packet window — the race moment.

ToolsTurbo Intruder/
Full Race Condition section ↗

Payload strings, code and technical terms are shown in English on purpose — payloads must be copied exactly as published.

Payloads originate from PayloadsAllTheThings (MIT) — use them only on programs you're authorized to test.

Payloads — wildhunter