View Issue Details

IDProjectCategoryView StatusLast Update
0009551Kali LinuxNew Tool Requestspublic2026-02-15 22:13
ReporterAdham Sabry Assigned To 
PrioritynormalSeverityminorReproducibilityhave not tried
Status newResolutionopen 
Summary0009551: Nexus-Race
Description

Purpose: To automate the exploitation of race conditions with microsecond accuracy.

  1. The Problem with Current Tools
    Most currently available tools (such as Intruder in Burp Suite) rely on sending sequential requests across separate threads. This approach suffers from network jitter, where requests arrive at the server with time gaps, thus keeping the race window closed to the attacker.
    Solution: Last-Byte Synchronization

The Nexus-Race tool doesn't rely on transmission speed, but rather on arrival timing. It employs a sophisticated offensive strategy:

HTTP/2 Multiplexing: Instead of opening 50 TCP connections (causing unnecessary strain and handshake delays), it uses a single connection to send dozens of streams.

The Last-Byte Technique: We send the complete data of all requests and store the last byte of each request in the program's cache.

Single-Packet Trigger: Once all streams are ready, the tool sends a single pulsed packet containing the missing bits for all requests. This ensures that the server's kernel will pass all requests to the application layer at the exact same moment.

Software Architecture

Go was chosen to build the tool for the following reasons:

Low-level Network Control: Go gives us complete control over TCP sockets and buffers.

Concurrency (Goroutines): The ability to manage thousands of concurrent requests with minimal RAM consumption.

Static Binary: The tool will be a single executable file, simplifying packaging for Debian and Kali Linux.

  1. Killer Features

Smart Diffing Engine: An analysis engine that compares response length, response time, and status codes to automatically detect anomalies.

Zero-Jitter Algorithm: An algorithm to calibrate network delays before initiating an attack to ensure the highest synchronization accuracy. Extensible Templates: Support for YAML files to define targeted endpoints (such as balance withdrawals, voting, password changes)
Killer Features

Smart Diffing Engine: An analysis engine that compares response length, response time, and status codes to automatically detect anomalies.

Zero-Jitter Algorithm: An algorithm that calibrates network delays before initiating an attack to ensure the highest synchronization accuracy.

Extensible Templates: Support for YAML files to define targeted endpoints (e.g., balance withdrawals, voting, password changes).

Activities

There are no notes attached to this issue.

Issue History

Date Modified Username Field Change
2026-02-15 22:13 Adham Sabry New Issue