ptmultirequest 0.0.1

Tool for synchronized multi-request race-condition checks

ptmultirequest — Race Condition Tester

ptmultirequest sends two or more identical HTTP requests at the exact same moment to help identify race condition vulnerabilities.

Use cases

• Can a user make two payments simultaneously when balance allows only one?
• Can two accounts be registered with the same login at the exact same time?

How it works

All requests are dispatched in parallel threads synchronized by a barrier — every thread waits until all are ready, then fires at once.

Responses are compared across all requests:

Field	What is checked
Status code	Are all responses the same HTTP status?
Response length	Does content length differ between responses?
Page title	Does the HTML <title> differ?
Keywords	Are error, warning, notice, or sql present in any response?

Any difference may indicate a race condition — manual review is always recommended.

Installation

pip install ptmultirequest

Usage

ptmultirequest -u https://example.com/pay -c 2
ptmultirequest -u https://example.com/register -d "login=admin" -c 2
ptmultirequest --request-file ./request.txt -c 5

Options

Flag	Description
-u, --url <url>	Target URL
-d, --data <post-data>	POST body (switches method to POST)
--request-file <file|base64>	Raw HTTP request from file or base64
-c, --count <n>	Number of synchronized requests (default: 2)
-p, --proxy <proxy>	Proxy URL (e.g. http://127.0.0.1:8080)
-T, --timeout <seconds>	Request timeout (default: 10)
--cookie <cookie>	Cookie header
-a, --user-agent <agent>	User-Agent header
-H, --headers <header:value>	Additional custom headers
-r, --redirects	Follow redirects
-j, --json	Output results as JSON
-v, --version	Show version
-h, --help	Show help

Dependencies

• ptlibs

License

Copyright (c) 2026 Penterep Security s.r.o.

ptmultirequest is free software licensed under the GNU General Public License v3.0 or later.

Legal notice

Only run this tool against targets you are explicitly authorized to test. Penterep bears no responsibility for unauthorized or malicious use. Be ethical.