Turbo Intruder 命令清单（对着你这个 jar 校准）

Burp → Extender → Extensions → Add
  Extension type: Java
  Select file: turbo-intruder-all .jar

┌─────────────────────────────────────────────┐
│ Request 模板（用 %s 当占位符）    [Attack]  │
├─────────────────────────────────────────────┤
│ Python 脚本编辑器（queueRequests / handleResponse）│
├─────────────────────────────────────────────┤
│ 结果表：payload | status | length | wordcount | time │
└─────────────────────────────────────────────┘

def queueRequests(target, wordlists):
    engine = RequestEngine(endpoint=target.endpoint,
                           concurrentConnections=5,
                           requestsPerConnection=100,
                           pipeline=False
                           )

    for i in range(3, 8):
        engine.queue(target.req, randstr(i), learn=1)
        engine.queue(target.req, target.baseInput, learn=2)

    for word in open('/usr/share/dict/words'):
        engine.queue(target.req, word.rstrip())


def handleResponse(req, interesting):
    if interesting:
        table.add(req)

RequestEngine(endpoint, callback=None, engine=Engine.THREADED,
              concurrentConnections=50, requestsPerConnection=100,
              pipeline=False, maxQueueSize=100, timeout=5,
              maxRetriesPerRequest=3, readCallback=None, readSize=1024,
              resumeSSL=True, autoStart=True)

class Engine:
    BURP     = 1   # 走 Burp 自身发包，可见于 Proxy history，慢，但一定能过 Burp 的 HTTP/2 栈
    THREADED = 2   # 线程池 + 原生 socket，默认。快，适合 HTTP/1
    ASYNC    = 3   # 异步原生 socket，HTTP/1
    HTTP2    = 4   # 异步 + HTTP/2 多路复用，竞态/单包测试用它

engine.queue(template, payloads=None, learn=0, callback=None, gate=None, label=None)
engine.openGate(gate)          # 放行被 gate 挂住的请求
engine.start(timeout=5)        # autoStart=False 时手动启动
engine.complete(timeout=-1)    # 等队列跑完再返回，竞态脚本必加
engine.userState               # dict，跨响应共享状态

req.status        # 状态码
req.length        # 响应长度
req.wordcount     # 单词数（比长度更抗随机噪声）
req.time          # 本次请求耗时（秒，浮点）—— 时序攻击靠它
req.response      # 完整原始响应字符串
req.label         # queue 时打的标签，用于分类处理
req.engine        # 反向拿到引擎，访问 userState
req.template      # 原始模板
req.words         # 本次用的载荷列表
req.request       # 实际发出的请求

def queueRequests(target, wordlists):
    engine = RequestEngine(endpoint=target.endpoint,
                           concurrentConnections=5,
                           requestsPerConnection=100,
                           pipeline=False)
    for word in open('pass.txt'):
        engine.queue(target.req, word.rstrip())

def handleResponse(req, interesting):
    if req.status != 404:
        table.add(req)

for u in open('users.txt'):
    for p in open('pass.txt'):
        engine.queue(target.req, [u.rstrip(), p.rstrip()])

def handleResponse(req, interesting):
    if '404 Not Found' not in req.response:
        table.add(req)
        for word in open('dirs.txt'):
            req.engine.queue(req.template, req.words[0] + '/' + word.rstrip())

req = '''GET / HTTP/1.1
Host: %s
Connection: keep-alive

'''
engines = {}
for domain in open('domains.txt'):
    d = domain.rstrip()
    engines[d] = RequestEngine(endpoint='https://' + d + ':443')

for word in open('words.txt'):
    for d, engine in engines.items():
        engine.queue(req, word.rstrip() + '.' + d)

import time
triedWords = 20        # 每 20 个词
timeSecs   = 5         # 停 5 秒
throttleMillisecs = 200

def queueRequests(target, wordlists):
    engine = RequestEngine(endpoint=target.endpoint,
                           concurrentConnections=5,
                           pipeline=False,
                           engine=Engine.BURP)   # BURP 引擎更温和
    n = 0
    for word in open('words.txt'):
        time.sleep(throttleMillisecs / 1000.0)
        engine.queue(target.req, word.rstrip())
        n += 1
        if n == triedWords:
            time.sleep(timeSecs)
            n = 0

def queueRequests(target, wordlists):
    engine = RequestEngine(endpoint=target.endpoint,
                           concurrentConnections=30,
                           requestsPerConnection=100,
                           pipeline=False)

    for i in range(30):
        engine.queue(target.req, target.baseInput, gate='race1')

    engine.openGate('race1')     # 非阻塞，把所有被挂住的请求一起放出去
    engine.complete(timeout=60)  # 等全部回来

def handleResponse(req, interesting):
    table.add(req)

def queueRequests(target, wordlists):
    engine = RequestEngine(endpoint=target.endpoint,
                           concurrentConnections=1,
                           requestsPerConnection=100)
    engine.userState['base_times'] = []
    for i in range(20):
        engine.queue(target.req, randstr(i), label='benchmark')
    for username in ['test', 'foo', 'admin']:
        engine.queue(target.req, username)

def handleResponse(req, interesting):
    if req.label == 'benchmark':
        req.engine.userState['base_times'].append(req.time)
    elif req.time > max(req.engine.userState['base_times']) + 10:
        table.add(req)

def queueRequests(target, wordlists):
    global engine
    engine = RequestEngine(endpoint=target.endpoint,
                           concurrentConnections=2,
                           readCallback=handleRead,
                           readSize=256)      # 单次 socket 读的大小
    engine.queue(target.req)

def handleRead(data):                        # data 只是"最后一次读到的内容"
    if 'token' in data:
        engine.queue('something-using-the-token')

for word in wordlists.clipboard:        # 直接吃剪贴板，一行一个
    engine.queue(target.req, word)
for word in wordlists.observedWords:    # 被动扫描期间见过的词
    engine.queue(target.req, word)

seed = 0
while True:                             # a, b, ... aaa, aab 无限生成
    batch = []
    seed = wordlists.bruteforce.generate(seed, 5000, batch)
    for word in batch:
        engine.queue(target.req, word)

def handleResponse(req, interesting):
    if interesting:                      # 与 learn 基线不同
        table.add(req)
    if req.status == 200 and req.length > 5000:
        table.add(req)
    if req.label == 'benchmark':
        pass                             # 基线样本不入表

1. 单 TCP 连接上复用 100 个请求            → requestsPerConnection 的指纹
2. HTTP/1.1 pipelining：一个连接里请求不等响应连发 → 顺序错乱的请求时间戳
3. 同一毫秒内并发命中同一接口，payload 不同   → 竞态攻击特征（正常业务几乎没有）
4. HTTP/2 单连接上瞬间涌出几十个 stream，时间差 < 1ms → 单包攻击特征
5. 请求节奏完全均匀（无人类点击间隔、无静态资源请求，只打同一个接口）
6. UA/Cookie 固定不变，Referer 缺失，只重复单一参数

- 按 (源IP, 目标接口) 做 1 秒窗口聚合：请求数 > 30 且参数各不相同 → 告警
- HTTP/2 统计单连接 stream 数：短时间内 > 20 个并发 stream 且路径相同 → 关注
- 登录/优惠券/提现这类"一次性语义"接口，同一账号在同一秒内出现多次成功 → 竞态告警
- 反向踩点：自家系统用这套脚本自测，能打出来的问题在日志里一定也能看见，
  这条链路（自测 → 看日志 → 写规则）比直接抄规则更值钱

1. Burp 装上 jar → 右键目标请求 → Send to Turbo Intruder
2. 模板把要变的位置改成 %s
3. 粘贴 3.1 或 3.6 的脚本
4. 填并发数、点 Attack
5. 看结果表 → 挑 interesting 的肉眼验证