search

PortSwigger / turbo-intruder

Turbo Intruder is a Burp Suite extension for sending large numbers of HTTP requests and analyzing the results.
https://portswigger.net/blog/turbo-intruder-embracing-the-billion-request-attack
Apache License 2.0
1.42k stars 207 forks source link

Question regarding race.py and queue implementations #132

Closed Tib3rius closed 1 year ago

Tib3rius commented 1 year ago

This isn't an issue but I didn't see it explained anywhere (apologies if I missed it) and it might be worth documenting the answer.

By default, the race.py example script has concurrentConnection=30 and requestsPerConnection=100. It also queues up 30 requests using range(30).

I presume then, that the default behavior when queuing up requests is to use a new connection if one is available? So we'd end up with 30 concurrent connections all with 1 request each? Which if we increased range(30) to range(60) would result in 30 connections with 2 requests each?

That seems to be the intuitive way of doing it, but I just wanted to make sure I was understanding how it worked!

Tib3rius commented 1 year ago

Ah, after I typed this I decided to play around with it some more and it seems that setting range(30) to range(60) without changing the concurrentConnection value causes an error "You have queued more gated requests than concurrentConnections, so your attack will deadlock".

I believe that answers my own question for me! I'll close this issue but if I'm wrong about something please let me know. :D