- Quickstart
- Engine Types - THREADED vs BURP vs BURP2
- Settings - Complete parameter reference for RequestEngine and queue()
- Response Processing - Callbacks, filtering, Burp integration
- Decorators - @MatchStatus, @FilterRegex, and other response filters
- Race Conditions & Timing Attacks - Gated requests, single-packet attacks, timing
- Performance Tuning - Maximize requests per second
- Wordlists & Utilities - Bruteforce, clipboard, random strings, multi-host
Example scripts are located in resources/examples/:
| Script | Description |
|---|---|
| default.py | Basic wordlist fuzzing |
| race-single-packet-attack.py | HTTP/2 single-packet race |
| timing.py | Statistical timing analysis |
| recursive.py | Recursive directory scanning |
| burpIntegration.py | Burp API integration |
| multiHost.py | Multi-host scanning |
- Turbo Intruder: Embracing the billion-request attack - Original blog post
- Smashing the state machine - Single-packet attack research
- Listen to the whispers - Web timing attacks