Winning web race conditions with the single-packet attack

Sun, 05 Jul 2026 00:00:00 +0000

Most write-ups tell you a race condition is a “timing window between check and use.” True, and useless — because the reason your race attacks fail isn’t that you don’t understand the concept. It’s that the window is smaller than the internet is precise.

A typical race window — the gap between an app reading balance and writing balance - amount — is measured in microseconds to a few milliseconds. The jitter between two HTTP requests you send at the same instant, by the time they arrive and get scheduled on the server, is routinely 1 to 10 milliseconds, and worse across the public internet. So your “simultaneous” requests arrive in a neat little line, the server processes them one at a time, the limit holds, and you conclude the endpoint is safe. It isn’t. You just lost the race to network jitter before the server ever got a vote.

Toctou on Crusader Research

Winning web race conditions with the single-packet attack