New techniques and tools for web race conditions
Summary: PortSwigger Research's James Kettle presented "Smashing the state machine: the true potential of web race conditions" at Black Hat USA '23 and DEF CON 31, introducing multiple new classes of web race condition beyond limit-overrun exploits. The work also unveils a single-packet attack that nullifies network jitter and sends multiple requests in parallel within a 1ms time window, with tooling released in Burp Repeater and an updated Turbo Intruder BApp extension for HTTP/2+.
Why it matters: Race-condition testing has been unreliable because network jitter hid all but the most trivial examples, and a 1ms parallel-request window removes that excuse - leaving newly exposed attack surface that most testers have never probed.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026