Collected research

Turbo Intruder: Embracing the billion-request attack

James Kettle · PortSwigger Research · 25 January 2019

A Burp extension built on a hand-written HTTP stack that sends requests far faster than normal tooling, reaching about 30,000 requests per second and sustaining multi-day attacks at flat memory. Python-scripted attacks, response filtering and a gate that releases requests simultaneously make large brute force and race-condition hunting practical.

Record

Researcher

James Kettle

Published by

PortSwigger Research

Date

25 January 2019

Topic

Other

In the archive

• Collected in the 2019 research round

Related sources

• Turbo Intruder
• Cracking reCAPTCHA, Turbo Intruder style
• Cracking reCAPTCHA, Turbo Intruder style (demonstration)

Tags

• tooling
• race-condition
• http
• http2
• timing-attack
• python
• bug-bounty
• owasp-a04-2021

This page is the archive's own catalogue record. The research is the work of James Kettle, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 11 August 2026.