Turbo Intruder – hacking at light speed 

By Indrajeet Bhuyan

Last week I wrote an article called “ 5 must-have burp suite extensions “. One of the extensions that I mentioned was Turbo Intruder. Today we will have a dedicated article only for turbo intruder. You might ask me why? The answer is that this tool is so awesome that it does deserve a dedicated article. 

We all love burp suite but the only thing that we hate about burp suite is the throttle. In the community version, the intruder speed is reduced. You might say to me hey I already have burp professional and I can use intruder at full speed do I still need a turbo intruder? My answer is yes. This is because turbo intruder makes scan so fast that even intruder in full speed cannot compete with it. 

How often do you find yourself running scans that take forever to complete? Often we end up cancelling the scan as it takes a lot of time. Let me introduce you to Turbo Intruder. Turbo Intruder is a research-grade open source Burp Suite extension built with speed in mind. It can send a large number of HTTP requests and analyze the result. Also, it uses way too less memory and the best part is that it’s completely free. 

 Here are some of the features of Turbo Intruder : 

1. Fast – Turbo Intruder uses an HTTP stack hand-coded from scratch with speed in mind. As a result, on many targets, it can seriously outpace even fashionable asynchronous Go scripts. 

2. Scalable – Turbo Intruder can achieve flat memory usage, enabling reliable multi-day attacks. It can also be run in headless environments via the command line. 

3. Flexible – Attacks are configured using Python. This enables the handling of complex requirements such as signed requests and multi-step attack sequences. Also, the custom HTTP stack means it can handle malformed requests that break other libraries. 

4. Convenient – Boring results can be automatically filtered out by an advanced diffing algorithm adapted from Backslash Powered Scanner. This means you can launch an attack and obtain useful results in two clicks. 

Installing Turbo Intruder  

1. Open burp suite and click on the extender and then click on BApp store. 

2. Now click on turbo Intruder 

3. Click on install

How to use turbo intruder 

1.First, intercept the request and send it to the turbo intruder 

2. Select the template 

Here you can find different templates which can help you do almost anything. For this example, I’m using the basic.py to brute force the web directory

Here is the code for basic.py 

3. Now I’ll add the wordlist and configure the following and click on attack 

concurrentConnections=1, 

requestsPerConnection=1, 

pipeline=False 

With this configuration, we get the following RPS 

Now lets change the configuration  

concurrentConnections=22, 

requestsPerConnection=1, 

pipeline=False 

Here I have changed the value of concurrent connection to 22. 

Now the RPS changes to around 25 which is much faster than the previous RPS 

Now here I have changed the value of request per connection to 100 

Now the RPS jumped to 1000+ 

Can we increase the speed further? Yes, we can. 

Now I changed the value of the pipeline from False to true 

Now the RPS went from 1000 to a massive 4000+ requests per second 

We can use turbo intruder for testing race conditions, rate limit, etc by selecting the right template 

This tool is for advanced users and the network stack is not stable. You can find the video documentation of this extension here: https://portswigger.net/research/turbo-intruder-embracing-the-billion-request-attack