Turbo Intruder
Turbo Intruder is a Burp Suite extension by James Kettle (PortSwigger) built for speed: it can sustain tens of thousands of HTTP requests per second, enabling what its accompanying research paper calls the billion-request attack. Where Burp’s built-in Intruder tops out at roughly hundreds of requests per second, Turbo Intruder’s custom HTTP stack — built around HTTP pipelining and a custom asynchronous engine — is designed for attacks that need enormous request volumes: massive race conditions, long brute-force runs, and HTTP desync research.
When to use it
- Race conditions — its “single-packet attack” (later ported into Burp Suite proper) sends 20–30 requests in a single TCP packet, eliminating network jitter and making last-byte synchronization far more reliable than parallel threads
- Rate-limit probing / resource exhaustion testing
- Long-running brute force where Burp Intruder is too slow
- As a complement to CLI fuzzers like wfuzz when you need Burp integration plus raw speed
Attacks are scripted in Python: a RequestEngine is configured with the target and a queueRequests function templates each request with %s placeholders, and handleResponse filters interesting results.
Engines and extension interoperability
Turbo Intruder has four request engines, with an important interoperability caveat:
Engine.THREADED— the default; fast, custom stackEngine.HTTP2— fast HTTP/2 engineEngine.BURP/Engine.BURP2— route requests through Burp’s own stack
The two fast built-in engines bypass Burp entirely, so requests they send are not processed by other Burp extensions (e.g. AWS Signer, which must sign every outgoing request). If your requests need to flow through another extension, you must use the Burp engine:
engine = RequestEngine(..., pipeline=True, engine=Engine.BURP)Engine.BURP2 works the same way for HTTP/2 targets. The tradeoff is speed: the Burp engines are the two slowest options precisely because they hand requests through Burp’s processing pipeline — which is what makes extension processing possible.
See also
- http-request-smuggling — the desync research Turbo Intruder was built alongside
- wfuzz — command-line web fuzzer alternative
- burp-suite-firefox, burp-suite-mobile-apps — other Burp workflows