Burp Suite Turbo Intruder Gains HTTP/3 Support for Accelerated Security Testing
PortSwigger's Burp Suite Turbo Intruder now supports HTTP/3, enabling security testers to achieve over 100,000 requests per second for faster and more comprehensive web application vulnerability assessments.
Burp Suite's powerful Turbo Intruder tool has been significantly enhanced with the addition of HTTP/3 support, a move that promises to dramatically accelerate security testing and uncover vulnerabilities previously missed due to speed limitations. This upgrade allows security professionals to push the boundaries of web application security assessments, potentially exceeding 100,000 requests per second even over standard Wi-Fi connections.
The new HTTP/3 engine in Turbo Intruder offers several key advantages for penetration testers. By leveraging the latest iteration of the HTTP protocol, the tool can achieve unprecedented speeds, enabling the use of larger and more complex test payloads. This is crucial in an era where sophisticated attacks can be masked by sheer volume, and where subtle race conditions or timing-based exploits might only be detectable with a high request rate.
For users of Burp Suite Professional, the 'AUTO' engine setting is recommended. This intelligent mode automatically selects the highest available HTTP version and dynamically tunes performance settings throughout an attack, adapting to changing network conditions. This is particularly beneficial for long-running tests where network stability can fluctuate. However, for specific attack types like desync attacks, the 'BURP' engine, which uses HTTP/1.1 with connection reuse disabled, remains the preferred choice.
Community Edition users will need to manually configure settings for optimal performance, incrementally increasing values until the request per second (RPS) counter plateaus or failures begin to occur. The tuning options include adjusting concurrent connections and requests per connection, with the 'pipeline' option in the THREADED engine being particularly useful if the server supports it.
Beyond raw speed, the update introduces new techniques for exploiting HTTP/3 specific race conditions. These include the 'Single Datagram Attack' and 'Server-Side Race Orchestration via the QPACK Blocked Streams' technique. These methods offer improved groupings compared to existing single-packet attacks, allowing for more precise targeting of smaller race windows, especially when the target exclusively supports HTTP/3.
Furthermore, Turbo Intruder now supports 'kettled' request syntax within the HTTP3 engine, mirroring its functionality in the BURP2 engine. This feature is essential for testing HTTP/3 downgrade attacks, where an attacker attempts to inject malicious headers by exploiting the transition from HTTP/3 to HTTP/1. The engine allows for the manipulation of pseudo-headers and the injection of special characters, providing a robust method for testing these specific downgrade scenarios.
To further broaden the scope of HTTP/3 testing, PortSwigger has also released an 'HTTP/3 Adapter' extension. This adapter translates traffic between HTTP/1.1 or HTTP/2 and HTTP/3, enabling testers to probe targets that exclusively support HTTP/3. This opens up a previously inaccessible attack surface, ensuring that security assessments are comprehensive across modern web infrastructure.
With these advancements, Burp Suite's Turbo Intruder is poised to become an even more indispensable tool for security professionals, empowering them to conduct faster, deeper, and more effective security testing against the evolving landscape of web applications and protocols.