PTMULTIREQUEST
ptmultirequest sends two or more identical HTTP requests at the exact same moment
to help identify race condition vulnerabilities.
Use cases
- Can a user make two payments simultaneously when balance allows only one?
- Can two accounts be registered with the same login at the exact same time?
How it works
All requests are dispatched in parallel threads synchronized by a barrier — every thread waits until all are ready, then fires at once.
Responses are compared across all requests:
| Field | What is checked |
|---|---|
| Status code | Are all responses the same HTTP status? |
| Response length | Does content length differ between responses? |
| Page title | Does the HTML <title> differ? |
| Keywords | Are error, warning, notice, or sql present in any response? |
Any difference may indicate a race condition — manual review is always recommended.
Installation
pip install ptmultirequest
Usage
ptmultirequest -u https://example.com/pay -c 2
ptmultirequest -u https://example.com/register -d "login=admin" -c 2
ptmultirequest --request-file ./request.txt -c 5
Options
| Flag | Description |
|---|---|
-u, --url <url> |
Target URL |
-d, --data <post-data> |
POST body (switches method to POST) |
--request-file <file|base64> |
Raw HTTP request from file or base64 |
-c, --count <n> |
Number of synchronized requests (default: 2) |
-p, --proxy <proxy> |
Proxy URL (e.g. http://127.0.0.1:8080) |
-T, --timeout <seconds> |
Request timeout (default: 10) |
--cookie <cookie> |
Cookie header |
-a, --user-agent <agent> |
User-Agent header |
-H, --headers <header:value> |
Additional custom headers |
-r, --redirects |
Follow redirects |
-j, --json |
Output results as JSON |
-v, --version |
Show version |
-h, --help |
Show help |
Dependencies
License
Copyright (c) 2026 Penterep Security s.r.o.
ptmultirequest is free software licensed under the GNU General Public License v3.0 or later.
Legal notice
Only run this tool against targets you are explicitly authorized to test. Penterep bears no responsibility for unauthorized or malicious use. Be ethical.
1 maintainer
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Filter files by name, interpreter, ABI, and platform.
If you're not sure about the file name format, learn more about wheel file names.
Copy a direct link to the current filters
File details
Details for the file ptmultirequest-0.0.3.tar.gz.
File metadata
- Download URL: ptmultirequest-0.0.3.tar.gz
- Upload date:
- Size: 20.1 kB
- Tags: Source
- Uploaded using Trusted Publishing? No
- Uploaded via: twine/7.0.0 CPython/3.13.15
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
87dbcf91e2e6d1bfa330a0d3e3ad87644946fc05d98659cf68d6421a3967565f
|
|
| MD5 |
986e687a8bfd1ecb8434734a9b506871
|
|
| BLAKE2b-256 |
01f035a50bca67c2bc87b04b04c4e28abb9ce04c2ea24bfebd8febadbd65f729
|
File details
Details for the file ptmultirequest-0.0.3-py3-none-any.whl.
File metadata
- Download URL: ptmultirequest-0.0.3-py3-none-any.whl
- Upload date:
- Size: 20.6 kB
- Tags: Python 3
- Uploaded using Trusted Publishing? No
- Uploaded via: twine/7.0.0 CPython/3.13.15
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
48b96a2a7b8b6f0a41cbc63526da86c1f7e88e6a6b10322e117e12bf246f55fa
|
|
| MD5 |
9688d4e2927625fd8a508bd9a1fe8a2b
|
|
| BLAKE2b-256 |
f33bdc41790a49f1add13fe04b813d234f47691f6eded7195d7faa1f74abfd3c
|
