PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

WebSocket Turbo Intruder: Unearthing the WebSocket Goldmine

portswigger.net | research | #burp-suite | #fuzzing | #prototype-pollution | #websocket | #race-conditions | #turbo-intruder
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

WebSocket Turbo Intruder brings Turbo Intruder's fast engine to WebSocket testing, fuzzing messages at high speed with smart filtering to uncover races, prototype pollution and access-control bugs.
Published
Collected

Related coverage

blog · portswigger.net
New techniques and tools for web race conditions
James Kettle's Black Hat and DEF CON talk introduces new web race condition classes beyond limit-overrun, plus the single-packet attack that sends parallel requests within 1ms, now in Burp Repeater.
research · portswigger.net
Introducing HTTP Anomaly Rank
James Kettle introduces HTTP Anomaly Rank, an algorithm that surfaces the most interesting HTTP responses from huge result sets. It ships in Turbo Intruder and Burp Suite's 2025.10 API.
research · portswigger.net
Practical Web Cache Poisoning
James Kettle's whitepaper shows how to turn web caches into exploit delivery systems, hijacking JavaScript and poisoning responses across popular sites, plus defenses and open source tooling.
research · portswigger.net
How to build custom scanners for web security research automation
Kettle shares his methodology for building custom scanners — automate the smallest possible step, avoid over-committing, embrace unexpected results — using his race-condition scanner as an example.
research · portswigger.net
The single-packet attack: making remote race-conditions 'local'
The single-packet attack completes multiple HTTP/2 requests in one TCP packet, eliminating jitter so remote race conditions behave like local ones; the post adapts it to more protocols.
research · portswigger.net
Smashing the state machine: the true potential of web race conditions
New race condition classes beyond limit-overrun exploits compromise major sites and the Devise Rails framework, powered by a single-packet attack squeezing 30 requests into a sub-1ms window.
Back