race
Conduct race condition testing using burst, single_packet, or staggered timing modes to reveal HTTP synchronization vulnerabilities.
Instructions
Race condition testing with burst, single_packet, and staggered timing modes. See rqwstr_docs(topic="race") for timing-mode guidance.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| sni | No | TLS SNI override. Decouples SNI from Host header for HTTPS requests. | |
| url | Yes | Target URL | |
| body | No | Request body | |
| grep | No | Regex to search response bodies | |
| name | No | Request name for result labeling | |
| count | No | Number of copies to send (default 10; ignored when payloads set) | |
| method | Yes | HTTP method | |
| timing | No | Timing mode: burst (default), single_packet (H2 single-frame attack), or staggered_us:N | |
| headers | No | Request headers | |
| payloads | No | Different payloads for each request (overrides count) | |
| raw_path | No | Send URL path exactly as provided without Go net/url normalization. Preserves percent-encoded sequences like %2f literally. For web cache deception and path traversal attacks. | |
| body_file | No | Relative path under hunt artifacts directory for request body; absolute paths require RQWSTR_ALLOW_ABSOLUTE_FILE_PATHS=1. Overrides body. | |
| multipart | No | Multipart form-data parts. Each part: {name, value, filename, content_type, body_file/file_path}. File paths are relative to hunt artifacts unless RQWSTR_ALLOW_ABSOLUTE_FILE_PATHS=1. Overrides body/body_file. | |
| timeout_ms | No | Per-request timeout in ms (default 30000) | |
| raw_headers | No | Raw headers string (\r\n-separated). Appended after headers map. Allows duplicate headers and non-standard formatting. | |
| session_setup | No | Chain-like steps to run before each burst. Fetches CSRF tokens and session state. Extracted variables substitute via double-brace syntax. Cookies auto-forward. | |
| payload_marker | No | Marker to replace with payload (default {{PAYLOAD}}) | |
| request_target | No | Override request-line target (RFC 7230 §5.3.2 absolute-form) | |
| grep_ignore_case | No | Case insensitive grep |