Turbo Intruder: Embracing the billion-request attack
Summary: PortSwigger researcher James Kettle released Turbo Intruder, an open source Burp Suite extension built on a hand-coded HTTP stack for sending large volumes of requests to a single host, with Python-configured attacks and automatic filtering of uninteresting responses. Kettle reports a maximum of 30,000 requests per second against a remote server and says the tool can run multi-day attacks with flat memory usage, including headless from the command line.
What's compelling: A freely available extension that sustains 30,000 requests per second against one host puts serious brute-force and race-condition testing within reach of anyone, and Kettle notes that targeting a resource-intensive page may slow a server for all its users.
Read the original at PortSwigger Research ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026