#!/usr/bin/env bash
# Vector 19: Race Condition
# Desc: TOCTOU, concurrent request race conditions
# Detect: Coupon codes, transfers, voting, limited-use operations
# Severity: MEDIUM
# Tools: curl

vector_race() {
  local target="$1"
  local report="$2"
  local findings=0
  
  print_info "Testing Race Condition vectors..."
  
  # Look for potential race targets
  local page=$(curl -s --connect-timeout 5 --max-time 10 "$target" 2>/dev/null)
  local race_indicators=""
  
  echo "\$page" | grep -qiE "coupon|discount|promo|free trial|voucher|transfer|withdraw|claim|vote|review|submit" && race_indicators="yes"
  
  if [ -n "$race_indicators" ]; then
    # Find endpoints to race
    local endpoints=$(echo "$page" | perl -nle 'print \$1 while /(action="[^"]*"|href="[^"]*")/g' | grep -iE "submit|claim|redeem|transfer|vote" | head -3)
    
    if [ -n "$endpoints" ]; then
      print_warn "Potential race condition targets found - manual testing recommended"
      print_info "Send multiple concurrent requests to the same endpoint"
      
      echo "SEVERITY: MEDIUM
VECTOR: Potential Race Condition
DETAIL: Possible race condition targets on $target
EVIDENCE: State-changing operations detected: coupon/claim/vote/transfer
EXPLOIT: Send 50+ concurrent requests: for i in {1..50}; do curl -X POST [endpoint] & done" > "$REPORTS_DIR/.finding_$(date +%s)_race.txt"
      findings=$((findings + 1))
    fi
  fi
  
  return $findings
}