X-BUR
Burp Turbo Intruder
PortSwigger's free, Python-scriptable Burp extension for high-throughput HTTP requests — built for race conditions and large-scale attacks.
OVERVIEW
Turbo Intruder is PortSwigger's free Burp extension (github.com/PortSwigger/turbo-intruder) built to send HTTP requests far faster and more efficiently than the built-in Intruder covered elsewhere on this site — it runs its own HTTP stack in Python, letting a short script define exactly how requests are queued and paced, down to firing a batch of requests within the same TCP packet ('single-packet attack') to win race-condition windows that are milliseconds wide.
Because attacks are plain Python scripts rather than a fixed set of attack types, it also handles large-scale fuzzing (millions of requests against a huge payload set) and multi-stage attacks that stock Intruder's UI can't express cleanly, at the cost of needing to write a small amount of code for each attack.
USE CASES
Practical use cases
- 01
Exploiting race conditions (e.g. redeeming a discount code or withdrawing funds twice) with single-packet-timed concurrent requests.
- 02
Fuzzing a parameter against a payload set too large for stock Intruder's throughput to finish in reasonable time.
- 03
Scripting multi-stage attacks (fetch a token, then use it) that need per-request logic Intruder's UI can't express.
- 04
Load-testing a rate limiter or lockout mechanism to confirm it holds up under genuine concurrent load.
QUICK START
When a test needs single-packet-timed requests or a throughput stock Intruder cannot reach — race conditions, limit-overrun bugs, large-scale fuzzing.
- Confirm that firing large bursts of near-simultaneous requests against this specific endpoint is authorized — race-condition testing can have real side effects (duplicate orders, double redemptions).
- Install Turbo Intruder from the BApp Store.
- Send a base request to Turbo Intruder and start from one of its bundled example scripts (race conditions, basic fuzzing, etc.).
- Edit the Python script to define the request queue, concurrency, and payloads for the specific attack.
- Run the attack and inspect results in Turbo Intruder's own results table, since it bypasses Burp's normal request history for speed.
BEFORE YOU RUN IT
What to check before running it
Race-condition proofs-of-concept can leave real duplicated side effects (an extra payout, a duplicated order) in the target system — agree with the client on cleanup before running one against production.
Its raw throughput can degrade or crash a fragile backend faster than stock Intruder would — start with a conservative concurrency setting on unfamiliar targets.
Requires editing a Python script per attack, which is more setup than point-and-click Intruder — budget the extra time when planning a timeboxed engagement.