HTTP/3 in Burp Suite - it’s time to find a bigger wordlist

Published: Wednesday, 23 September 2026 at 14:00 UTC Updated: Wednesday, 23 September 2026 at 15:27 UTC How many bugs have you missed because you didn’t send quite enough HTTP requests? Turbo Intruder now supports HTTP/3, can comfortably exceed 100,000 requests per second over Wi-Fi, and auto-tunes for maximum performance. With our new HTTP/3 Adapter plugin, Burp Suite now supports HTTP/3 too. Read on to learn how to use this new toolkit to: Achieve maximum speedExploit HTTP/3 Race conditionsExploit HTTP/3 downgradingTest HTTP/3 only targets 1 million requests in 10 seconds over Wi-Fi How to achieve maximum speed in Turbo Intruder In Embracing the Billion Request Attack we were able to hit 30,000 requests per second (RPS) over HTTP/1.1. From my laptop while using the HTTP3 engine, I was able to hit 100,000 RPS to a remote host over Wi-Fi. When fuzzing over any protocol, you’ll first want to minimise the size of your request and response (using the HEAD method, or Range header). GET / HTTP/1.1 Range: bytes=-1 //Only return the last byte HTTP/1.1 206 Partial Content Content-Range: bytes 9999-9999/10000 Content-Length: 1

The Host header can be skipped when using the HTTP3 engine because the :authority pseudo header is implied by the target. Next, you’ll want to adjust the engine’s configuration. If you’re using Burp Suite Professional, you can simply swap to the AUTO engine, which will automatically select the highest HTTP version available and then dynamically tune the required settings as your attack runs. This is particularly powerful for long-running attacks, where the network state may degrade or improve over time. HTTP/1.1's pipelining feature is not supported in the AUTO engine. You may be able to achieve higher RPS over HTTP/1.1 when using the THREADED engine if you enable pipelining manually. If you’re attempting a desync attack, AUTO is not recommended. Instead use the BURP engine which uses HTTP/1.1 with connection reuse disabled. If you’re using the Community Edition, you’ll need to configure each setting manually depending on the engine. For each setting you want to increase its value until the RPS counter plateaus, or you start seeing failures. The only exception to this, is when using the THREADED engine’s pipeline option, which should be set to True if the server supports it. Available tuning options: EngineTuning …