HTTP/3 in Burp Suite

* Turbo Intruder supports HTTP/3.
* Turbo Intruder can exceed 100,000 requests per second over Wi-Fi.
* A new HTTP/3 Adapter plugin is available for Burp Suite.
* Fuzzing should minimize request/response size using HEAD or Range headers.
* The Host header can be skipped when using the HTTP3 engine due to the :authority pseudo-header.
* AUTO engine automatically selects the highest HTTP version and tunes settings dynamically.
* THREADED engine tuning options are concurrentConnections, requestsPerConnection, and pipeline=True.
* BURP2 engine tuning option is concurrentConnections.
* HTTP3 engine tuning option is concurrentConnections.
* Two new race condition techniques are available when using the HTTP3 engine: Single Datagram Attack from QUIC-er Races and Server-Side Race Orchestration via QPACK Blocked Streams.
* Kettled request syntax is supported in Turbo Intruder via special character escapes for CRLF, space, null, CR, LF, hex codes, and literal characters.
* The HTTP/3 Adapter extension converts traffic from HTTP/1.1 or HTTP/2 to HTTP/3 with modes: Explicit HTTP/3 only or Always HTTP/3 where possible.

The introduction of HTTP/3 support combined with advanced fuzzing techniques fundamentally shifts the landscape of performance testing, moving beyond simple request volume toward exploiting protocol-level race conditions and traffic manipulation. The shift toward an automated AUTO engine suggests a design prioritizing dynamic adaptation over static configuration, which implies that predictable attack surfaces might be less exploitable if the system can continuously self-tune against evolving network states. The focus on HTTP/3-specific race conditions—like those derived from QUIC-er Races and QPACK stream manipulation—signals an evolution in vulnerability discovery where temporal inconsistencies within the protocol itself become primary attack vectors, rather than just payload manipulation. Furthermore, the mechanism for handling request syntax through "kettleled requests" demonstrates a layer of semantic obfuscation applied at the transport/application layer, allowing attackers to probe downgrade vulnerabilities by attempting to force protocol negotiation (e.g., HTTP/3 to HTTP/1.1). The existence of an adapter that automatically shifts traffic to HTTP/3 suggests that achieving maximum performance might inherently require bypassing traditional networking expectations, which carries implications for how network infrastructure is assumed and validated during security testing. The central tension lies between the desire for high-speed exploitation and the need for maintaining verifiable state across heterogeneous protocols.
BRIDGE QUESTIONS: If performance is maximized by dynamic tuning and exploiting protocol races, what are the long-term security implications for infrastructure that relies on strict adherence to layered protocol specifications? How does the abstraction provided by tools like the HTTP/3 Adapter change the operational responsibility of defenders regarding multi-protocol traffic analysis? What safeguards must be built into systems to prevent self-tuning mechanisms from inadvertently creating novel, unpatchable vulnerabilities?