3

I want to test some application by sending 2 or more requests at the same time (at the same second or even millisecond) using Burp Suite.

By using Intruder or Repeater I can't do that at literally one moment. They both have the delay is long per second and this is not what I need. So, how can I do that using Burp Suite? Or, if it is impossible, is there other way to send a couple of requests at one moment?

Improve this question
3
  • Why do you need to use burp specifically and can't use a simple python script? And why at the same millisecond?
    – user163495
    Commented Dec 18, 2021 at 19:45
  • I just want to test how server works, when I send requests this way, and I thought Burp Suite would be perfect instrument
    – dokichan
    Commented Dec 18, 2021 at 20:22
  • I've never seen a web application vulnerability that depends on millisecond timing. This definitely is a very, very specific kind of test case, and one that is better suited for a custom script.
    – user163495
    Commented Dec 18, 2021 at 21:02

2 Answers 2

Reset to default
3

In short: You can't, at least not with vanilla Burp. There may be an extension for it, but I don't know of any that does this. So, what can you do?

Develop An Extension

Burp is quite extensible, and there are a lot of extensions for Burp already. If you wanted to, you could create your own extension that sends two HTTP requests as closely together as possible by the OS and hardware.

Develop A Script

The quicker approach would be to write a script for it. Python is probably a good choice, since there's a library for anything there already. I'm fairly confident that it shouldn't be that difficult to write a script that sends two HTTP requests as closely together as the OS and hardware allow.

Improve this answer
1
  • Scapy is your Python friend, it's a FITM (friend in the middle).
    – A. Hersean
    Commented Jan 3, 2022 at 9:28
3

I believe it is possible using multiple threads in Intruder. Choose "Null Payload" to send repeated identical requests and create a new resource pool with increased max concurrent requests. Your new pool with maximum concurrent requests set to 100 and 1 ms delay between requests will send 10 requests all at once. You could also use multiple Intruder tabs if you needed the requests to be slightly different from one another.

This information is taken from the forum post: How Do I send Multiple Requests at one Time

Intruder Resource Pool

I tested this (Burp Pro Edition) and it sent all my requests seemingly instantly. According to Burp Logger the times were as follows (if you are still seeing a delay it may be because the free edition is rate limited):

2022-01-03T02:18:07.444Z

2022-01-03T02:18:07.408Z

2022-01-03T02:18:07.429Z

2022-01-03T02:18:07.461Z

2022-01-03T02:18:07.429Z

2022-01-03T02:18:07.445Z

2022-01-03T02:18:07.451Z

2022-01-03T02:18:07.477Z

2022-01-03T02:18:07.671Z

2022-01-03T02:18:07.472Z

2022-01-03T02:18:07.463Z

2022-01-03T02:18:07.492Z

2022-01-03T02:18:07.486Z

There actually is a web vulnerability that may depend on such close timing. I encountered an app with a multi-threading issue where you could get other people's data if the requests were close together.

Improve this answer
1
  • 1
    this should be the accepted answer since it provides a solution using burp
    – r4cc00n
    Commented Jun 14, 2023 at 11:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .