loading
Loading content
loading
Scanners
Black Hat Arsenal HTTP/3 client for Quic-Fin-Sync race testing and fuzzing over QUIC.
overview
quicdraw sends HTTP/3 requests over QUIC and is built to make several of them land at the same moment. The technique upstream calls Quic-Fin-Sync holds the requests until their final frames can be released together, which is what turns a theoretical race window into one you can observe: two redemptions of a single coupon, two withdrawals against one balance.
HTTP/3 matters for this because the tooling gap is real. Most fuzzers and race tools speak HTTP/1.1 or HTTP/2, so an endpoint reached over QUIC often ends up tested through a different path than the one users take. quicdraw tests the transport in production rather than a proxy of it, and it fuzzes over the same connection with a FUZZ placeholder and a wordlist on -w.
The node takes a single --url or a one-URL file, with the file port preferred so a baseline pass and a race pass read the same target. Output is findings.jsonl plus the response body, which is what lets the HTTP/3 Race Fuzzer run both passes and diff them into evidence instead of a claim.
use cases
Race an endpoint that grants a coupon, a credit, or a withdrawal and see whether concurrent HTTP/3 requests both succeed.
Run a single request and a concurrent burst against the same URL, then diff the responses so the finding rests on evidence.
Put a FUZZ placeholder in the URL or body and pass a wordlist so the fuzzing path uses the transport that users actually reach.
Reach hosts that negotiate HTTP/3 with tooling that speaks it, instead of testing a downgraded path that behaves differently.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| url | STRING | --url | HTTPS URL on an HTTP/3-capable host (optional if url-file is set) |
| url-file | FILE | --url-file | File with one HTTPS URL (preferred, keeps baseline and race in sync) |
| race | STRING | --race | Number of concurrent race requests (-tr) |
| wordlist | FILE | -w | Optional fuzz wordlist (FUZZ placeholder in URL or body) |
Showing key inputs. quicdraw exposes 4 inputs in total.
example
# baseline: one request over HTTP/3quicdraw --url https://www.example.com/api/redeem # race: concurrent requests released togetherquicdraw --url-file url.txt --race 20{ "tool": "quicdraw", "url": "https://www.example.com/api/redeem", "alpn": "h3", "race": 20, "accepted": 3, "expected": 1, "severity": "high", "note": "Three concurrent redemptions accepted where the limit allows one"}guidance
Reach for quicdraw when the target negotiates HTTP/3 and the question is a race window or a fuzz case on that transport. Use ffuf for high-throughput fuzzing over HTTP/1.1 and HTTP/2, and use httpx first when you still need to know which hosts speak HTTP/3 at all.
Faster and broader for fuzzing, but it does not speak HTTP/3 and cannot synchronize request completion over QUIC.
Probes hosts and reports protocol support. Run it first to find HTTP/3 endpoints, then race them here.
Template checks across many classes. It covers known issues; a race window needs concurrent requests it does not orchestrate.
workflows
faq
related
BHUSA Arsenal TLS/SSH crypto inventory with post-quantum readiness signals and CBOM-shaped output.
Reflection triage for parameter URLs during recon.
Black Hat Arsenal hunting for phantom IAM users behind Bedrock keys, with offline key decode and org scan.
CMS detection and version fingerprinting.
Signature-driven web application scanner.
OWASP Joomla vulnerability scanner for CMS flaws and misconfigurations.
One HTTP/3 URL feeds quicdraw, which sends a baseline and a synchronized race burst and writes findings plus response bodies.
Facts on this page come from the live Trickest tool library.